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ABSTRACT. Currently, there is renewed interest in the problem, raised by Shafer in 1985, 
of updating probabilities when observations are incomplete (or set-valued). This is a fun- 
damental problem in general, and of particular interest for Bayesian networks. Recently, 
Griinwald and Halpern have shown that commonly used updating strategies fail in this case, 
except under very special assumptions. In this paper we propose a new method for updating 
probabilities with incomplete observations. Our approach is deliberately conservative: we 
make no assumptions about the so-called incompleteness mechanism that associates com- 
plete with incomplete observations. We model our ignorance about this mechanism by a 
vacuous lower prevision, a tool from the theory of imprecise probabilities, and we use only 
coherence arguments to turn prior into posterior (updated) probabilities. In general, this 
new approach to updating produces lower and upper posterior probabilities and previsions 
(expectations), as well as partially determinate decisions. This is a logical consequence of 
the existing ignorance about the incompleteness mechanism. As an example, we use the 
new updating method to properly address the apparent paradox in the 'Monty Hall' puzzle. 
More importantly, we apply it to the problem of classification of new evidence in proba- 
bilistic expert systems, where it leads to a new, so-called conservative updating rule. In 
the special case of Bayesian networks constructed using expert knowledge, we provide an 
exact algorithm for classification based on our updating rule, which has linear-time com- 
plexity for a class of networks wider than polytrees. This result is then extended to the 
more general framework of credal networks, where computations are often much harder 
than with Bayesian nets. Using an example, we show that our rule appears to provide a 
solid basis for reliable updating with incomplete observations, when no strong assumptions 
about the incompleteness mechanism are justified. 



1. Introduction 

Suppose you are given two Boolean random variables, C and A. C — 1 represents the 
presence of a disease and A = 1 is the positive result of a medical test. You know that 
p(C = 0,A = 0) = 0.99 and that p(C = 1,A = 1) = 0.01, so the test allows you to make 
a sure diagnosis. However, it may happen that, for some reason, the result of the test is 
missing. What should your diagnosis be in this case? You might be tempted to say that 
the posterior probability of C = 0, conditional on a missing value of A, is simply p(C = 
0|A G {0, 1}) = p(C — 0) = 0.99, and that the diagnosis is 'no disease' with high proba- 
bility. After all, this looks like a straightforward application of Kolmogorov's definition of 
conditional probability, which appears in many textbooks: P(B\E) = P(BnE)/P(E), for 
generic events B and E, with P(E) > 0. 

Unfortunately, it turns out that the above inference is wrong unless a condition known 
in the literature as MAR (missing at random) is satisfied. MAR states that the probability 
that a measurement for A is missing, is the same both when conditioned on A = and when 
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conditioned on A = 1, or, in other words, that there is no systematic reason for the missing 
values of A [25]. 

The example above is a special case of the more general problem of updating proba- 
bilities with observations that are incomplete, or set-valued: it could be argued that the 
fact that a measurement for A is missing corresponds to a set- valued observation of {0, 1} 
for A rather than the complete or point-valued observations or 1 . The difficulty we are 
facing is then how to update p with such incomplete observations. To our knowledge, this 
problem was given serious consideration for the first time in 1985 by Shafer [33]. Rather 
than taking traditional conditioning as a definition, Shafer derived it from more primitive 
notions showing that the right way to update probabilities with incomplete observations 
requires knowledge of what we shall call the incompleteness mechanism (called protocol 
in Shafer's paper), i.e., the mechanism that is responsible for turning a complete obser- 
vation into an incomplete one. Shafer's result tells us that neglecting the incompleteness 
mechanism leads to a naive application of conditioning (also called naive conditioning or 
naive updating in the following) that is doomed to failure in general. This is evident when 
one addresses well-known puzzles by naive conditioning, such as the three prisoners prob- 
lem and the Monty Hall puzzle. What the implications are in practise for more realistic 
applications of probability theory, was partially addressed by Shafer when he observed 
that "we do not always have protocols in practical problems." In the example above, for 
instance, we may not know which is the probability that a measurement A is missing con- 
ditional on A = and conditional on A = 1 (such a conditional probability is a specification 
of the protocol, or incompleteness mechanism). We may not even know whether the two 
probabilities are equal . . . 

Surprisingly, Shafer's thesis seems to have been largely overlooked for many years. 1 
Kolmogorov's influential formalisation of probability theory [22] may have contributed in 
this respect: the way the definition of conditioning is presented seems to suggest that one 
may be totally uninformed about the incompleteness mechanism, and still be allowed to 
correctly update beliefs after receiving some evidence E. That is, it seems to suggest that 
naive updating is always the correct way to update beliefs. Actually, the definition pro- 
duces correct results when MAR does not hold only if the underlying possibility space is 
built in such a way as to also model the incompleteness mechanism. Apart from the influ- 
ence of Kolmogorov's formalisation, we might identify the unclear practical implications 
of Shafer's work as another reason for its being considered by many as something of a 
statistical curiosity. 

The situation has changed recently, when an interesting paper by Griinwald and Halpern 
[14] kindled a renewed interest in the subject. In that work, strong arguments are presented 
for the following two theses: (i) the incompleteness mechanism may be unknown, or dif- 
ficult to model; and (ii) the condition of coarsening at random (or CAR [13], a condition 
more general than MAR), which guarantees that naive updating produces correct results, 
holds rather infrequently. These two points taken together do raise a fundamental issue in 
probability theory, which also presents a serious problem for applications: how should one 
update beliefs when little or no information is available about the incompleteness mecha- 
nism? 

In the above example, the mechanism might very well be such that A cannot be observed 
if and only if A has the value 0, and then C = would be a certain conclusion. But it might 
equally well be the case that A cannot be observed if A = 1, in which case C = 1 would be 



But see the discussion in [37, Section 6.11], which has been a source of inspiration for the present work; and 
some papers by Halpern et at [15, 16]. 
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certain. Of course, all the intermediate randomised cases might also be possible. It follows 
that the posterior probability of C = can, for all we know, lie anywhere in the interval 
[0, 1], and our ignorance does not allow us to say that one value is more likely than another. 
In other words, this probability is vacuous. Thus, knowing that the value of A is missing, 
produces complete ignorance about this probability and, as a result, total indeterminacy 
about the diagnosis: we have no reason to prefer C = over C = 1, or vice versa. All 
of this is a necessary and logical consequence of our ignorance about the incompleteness 
mechanism. We cannot get around this indeterminacy, unless we go back to the medical 
test and gather more relevant information about how it may produce missing values. 

Generally speaking, we believe that the first step to answer the question above is to 
recognise that there may indeed be ignorance about the incompleteness mechanism, and to 
allow for such ignorance in our models. This is the approach that we take in this paper. In 
Section 3, we make our model as conservative as possible by representing the ignorance 
about the incompleteness mechanism by a vacuous lower prevision, a tool from the theory 
of imprecise probabilities [37]. Because we are aware that readers may not be familiar 
with imprecise probability models, we present a brief discussion in Section 2, with point- 
ers to the relevant literature. 2 Loosely speaking, the vacuous lower prevision is equivalent 
to the set of all distributions, i.e., it makes all incompleteness mechanisms possible a pri- 
ori. Our basic model follows from this as a necessary consequence, using the rationality 
requirement of coherence. This coherence is a generalisation to its imprecise counterpart 
of the requirements of rationality in precise, Bayesian, probability theory [9]. We illustrate 
how our basic model works by addressing the Monty Hall puzzle, showing that the appar- 
ent paradox vanishes if the knowledge that is actually available about the incompleteness 
mechanism is modelled properly. 

We then apply our method for dealing with incomplete observations to the special case 
of a classification problem, where objects are assigned to classes on the basis of the values 
of their attributes. The question we deal with in Section 4, is how classification should be 
done when values for some of the attributes are missing. We derive a new updating rule that 
allows us to deal with such missing data without making unwarranted assumptions about 
the mechanism that produces these missing values. We regard this so-called conservative 
updating rule as a significant step toward a general solution of the updating problem. Our 
rule leads to an imprecise posterior, and as we argued above, it may lead to inferences that 
are partially indeterminate. It may for instance happen that, due to the fact that certain of 
the attribute values are missing, our method will assign an object to a number of (optimal) 
classes, rather than to a single class, and that it does not express any preference between 
these optimal classes. This generalised way of doing classification is also called credal 
classification in [41]. As we have argued above, we have to accept that this is the best 
our system can do, given the information that is incorporated into it. If we want a more 
precise classification, we shall have to go back and find out more about the mechanism that 
is responsible for the fact that some attributes are missing. But, given the characteristics of 
our approach, any such additional information will lead to a new classification that refines 
ours, but can never contradict it, i.e., assign an object to a class that was not among our 
optimal classes in the first place. 

In Section 5, we then apply the updating rule for classification problems to Bayesian 
networks. We regard a Bayesian net as a tool that formalises expert knowledge and is used 
to classify new evidence, i.e., to select certain values of a class variable given evidence 
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about the attribute values. We develop an exact algorithm for credal classification with 
Bayesian nets that is linear in the size of the input, when the class node together with its 
Markov blanket is a singly connected graph. Extension to the general case is provided 
by an approach analogous to loop cutset conditioning. Section 6 applies the algorithm 
to an artificial problem and clarifies the differences with naive updating. There are two 
important implications of the algorithmic complexity achieved with Bayesian nets: the 
algorithm makes the new rule immediately available for applications; and it shows that 
it is possible for the power of robust, conservative, modelling to go hand in hand with 
efficient computation, even for some multiply connected networks. This is enforced by our 
next result: the extension of the classification algorithm to credal networks, in Section 7, 
with the same complexity. Credal networks are a convenient way to specify partial prior 
knowledge. They extend the formalism of Bayesian networks by allowing a specification 
in terms of sets of probability measures. Credal nets allow the inherent imprecision in 
human knowledge to be modelled carefully and expert systems to be developed rapidly. 
Such remarkable advantages have been partially overshadowed so far by the computational 
complexity of working in the more general framework of credal nets. Our result shows that 
in many realistic scenarios, the computational effort with credal networks is the same as 
that required by Bayesian nets. This may open up a wealth of potential applications for 
credal networks. 

The concluding Section 8 discusses directions and open issues for future research. Ad- 
ditional, technical results have been gathered in the appendices. 

2. Basic notions from the theory of imprecise probabilities 

The theory of coherent lower previsions (sometimes also called the theory of imprecise 
probabilities 3 ) [37] is an extension of the Bayesian theory of (precise) probability [7, 9]. It 
intends to model a subject's uncertainty by looking at his dispositions toward taking certain 
actions, and imposing requirements of rationality, or consistency, on these dispositions. 

To make this more clear, consider a random variable X that may take values in a finite 4 
set X. A gamble f on the value of X, or more simply, a gamble on X, is a real-valued 
function on X. It associates a (possibly negative) reward 5 f(x) with any value x the random 
variable X may assume. If a subject is uncertain about what value X assumes in X, he 
will be disposed to accept certain gambles, and to reject others, and we may model his 
uncertainty by looking at which gambles he accepts (or rejects). 

In the Bayesian theory of uncertainty (see for instance [9]), it is assumed that a subject 
can always specify a fair price, or prevision, P(f) for /, whatever the information available 
to him. P(f) is the unique real number such that the subject (i) accepts the gamble / — p, 
i.e., accepts to buy the gamble / for a price p, for all p < P(f); and (ii) accepts the gamble 
q — f, i.e., accepts to sell the gamble / for a price q, for all q > P(f). In other words, it is 
assumed that for essentially any real number r, the available information allows the subject 
to decide which of the following two options he prefers: buying / for price r, or selling / 
for that price. 

It has been argued extensively [34, 37] that, especially if little information is available 
about X, there may be prices r for which a subject may have no real preference between 

3 Other related names found in the literature are: indeterminate probabilities, interval (or interval-valued) 
probabilities, credal sets, . . . 

4 For simplicity, we shall only deal with variables with a finite number of possible values in this paper. 

5 In order to make things as simple as possible, we shall assume that these rewards are expressed in units of 
some predetermined linear utility. 
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these two options, or in other words, that on the basis of the available information he 
remains undecided about whether to buy / for price r or to sell it for that price: he may 
not be disposed to do either. If, as the Bayesian theory requires, the subject should choose 
between these two actions, his choice will then not be based on any real preference: it 
will be arbitrary, and not a realistic reflection of the subject's dispositions, based on the 
available information. 

2.1 . Coherent lower and upper previsions. The theory of imprecise probabilities reme- 
dies this by allowing a subject to specify two numbers: P(f) and P(f). The subject's 
lower prevision P(f) for / is the greatest real number p such that he is disposed to buy the 
gamble / for all prices strictly smaller than p, and his upper prevision P(f) for / is the 
smallest real number q such that he is disposed to sell / for all prices strictly greater than 
q. For any r between P(f) and P(f), the subject does not express a preference between 
buying or selling / for price r (see Figure 1). 

a) p P(f) q 

1 ; 1 



buy / for price p 



sell / for price q 



b) P P(f) P(f) 4 

1 1 1 1 

i i 

buy / for price p \ no action ! sell / for price q 



FIGURE 1 . Buying and selling a gamble / in (a) the Bayesian theory, 
and (b) in imprecise probability theory 

Since selling a gamble / for price r is the same thing as buying — / for price — r, we 
have the following conjugacy relationship between lower and upper previsions 

P(f) = -£(-/)■ (1) 

This tells us that whatever we say about upper previsions can always be reformulated in 
terms of lower previsions. We shall therefore concentrate on lower previsions. It will for 
the purposes of this paper suffice to consider lower previsions P that are defined on the set 
£(X) of all gambles on X, i.e., P is considered as a function that maps any gamble / on X 
to the real number P(f). 

An event A is a subset of X, and it will be identified with its indicator Ia, which is a 
gamble assuming the value one on A and zero elsewhere. We also denote P(Ia) by P(A) and 
call it the lower probability of the event A. It is the supremum rate for which the subject is 
disposed to bet on the event A. Similarly, the upper probability P(A) = P(Ia) = 1 — P(coA) 
is one minus the supremum rate for which the subject is disposed to bet against A, i.e., to 
bet on the complementary event coA. Thus, events are special gambles, and lower and 
upper probabilities are special cases of lower and upper previsions. We use the more 
general language of gambles, rather than the more common language of events, because 
Walley [37] has shown that in the context of imprecise probabilities, the former is much 
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more expressive and powerful. For this reason, we consider 'lower prevision' to be the 
primary notion, and 'lower probability' to be derived from it; and we follow de Finetti's 
[9] and Walley's [37] example in using the same symbol P for both (lower) previsions and 
(lower) probabilities. Standard probabilistic practice would have us use the symbols E for 
expectation/prevision and P for probability here. 7 

Since lower previsions represent a subject's dispositions to act in certain ways, they 
should satisfy certain criteria that ensure that these dispositions are rational. Coherence 
is the strongest such rationality requirement that is considered in the theory of imprecise 
probabilities. For a detailed definition and motivation, we refer to [37]. For the purposes of 
the present discussion, it suffices to mention that a lower prevision P on £(X) is coherent 
if and only if it satisfies the following properties, for all gambles / and g on X, and all 
non-negative real numbers X: 

(PI) min^ 6 x/W <E.(f) [accepting sure gains]; 
(P2) P(f + g)>P(f)+P(g) [super-additivity]; 
(£3) P(Xf)=XP(f) [positive homogeneity]. 

Observe that for a coherent P, we have that P(f) > P(f) for all / e £(X). 

2.2. Linear previsions. It follows from the behavioural interpretation of lower and upper 
previsions that if P(f) = P(f) f° r some gamble /, then this common value is nothing but 
the fair price, or prevision, P(f) of /, as discussed in the previous section. A linear previ- 
sion P on £(X) is defined as a real-valued map on £(X) that is coherent when interpreted 
as a lower prevision, and self-conjugate in the sense that P(f) = —P(—f) for all gambles 
/, so the conjugate upper prevision of P is also given by P. This implies that a linear pre- 
vision P should satisfy the following properties, for all gambles / and g on X, and all real 
numbers X : 

(PI) mm xeX f(x) <P(f) <max xex f(x); 
(P2) P(f + g)=P(f)+P(g); 
(P3) P(Xf) = XP(f). 

This follows at once from the characterisation (P1)-(P3) of a coherent lower prevision, 
and the conjugacy relationship (1). Thus, linear previsions turn out to be exactly the same 
thing as de Finetti's coherent previsions [7, 9]. They are the so-called precise probability 
models, which turn out to be special cases of the more general coherent imprecise probabil- 
ity models. Any linear prevision P is completely determined by its so-called mass function 
p, defined by p(x) = P({x}), since it follows from the axioms (P2) and (P3) that for any 
gamble /, 

P{f)=l t f(x)p(x) 

is the expectation of / associated with the mass function p. We denote the set of all linear 
previsions on £(X) by 3 3 (X). 

2.3. Sets of linear previsions. With any lower prevision P on £ (X), we can associate its 
set of dominating linear previsions: 

M(P) = {P e ?(X) : (V/ e L(X))(P(f) < P(f))}- 



'We shall see in Section 2.2 that for precise probabilities, both languages turn out to be equally expressive. 
Instead, we shall reserve the symbol E for natural extension. 
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Observe that this set M(P) is convex and closed. It turns out that the lower prevision P is 
coherent if and only if M(P) 7^ 0, and if moreover P is the lower envelope of M(P): for all 
gambles / on X, 9 

P(/)=inf {P(/): PeM(P)}. 

Conversely, the lower envelope P of any non-empty subset M of J'(X), defined by P(f) = 
inf{P(/): P G M} for all / G £(X), is a coherent lower prevision. Moreover M(P) = 
CH(M), where CH(M) is the convex closure (i.e., the topological closure of the convex 
hull) of M [37, Chapters 2 and 3] . This tells us that working with coherent lower previsions 
is equivalent to working with convex closed sets of linear previsions. It also tells us that 
a coherent lower prevision P is also the lower envelope of the set ext(M(P)) of the set of 
extreme points of M(P). 

This brings us to the so-called Bayesian sensitivity analysis interpretation of a lower 
prevision P or a set of linear previsions M. On this view, a subject's uncertainty should 
always be described by some ideal probability measure, or equivalently, by some linear 
prevision Pp. We could call this the assumption of ideal precision. Due to lack of time, 
resources or elicitation, we may not be able to uniquely identify Pj, but we may often 
specify a set M such that we are certain that Pj G M, or equivalently, a lower prevision P 
such that P<Pt- On this view, any conclusions or inferences we derive from the available 
information must be robust: they must be valid for all possible candidates P G M for 
the ideal prevision Pj. Although we emphatically do not make the assumption of ideal 
precision in this paper, we shall see that many of the results we derive, are compatible with 
it, i.e., they can also be given a Bayesian sensitivity analysis interpretation. 

2.4. Vacuous lower previsions. There is a class of coherent lower previsions that de- 
serves special attention. Consider a non-empty subset B of X. Then the vacuous lower 
prevision P B relative to B is defined by 

P B (f) = mm f(x) (2) 

for all gambles / on X. Verify that P B is a coherent lower prevision, and moreover 

M(P B ) = {Pey(X): P(B) = l}. 

This tells us that P B is the smallest (and therefore most conservative) coherent lower previ- 
sion P on £(X) that satisfies P(B) = 1 (and therefore P(B) = P(B) = 1). P(B) = 1 means 
that it is practically certain to the subject that X assumes a value in B, since he is disposed 
to bet at all non-trivial odds on this event. Thus, in the context of the theory of lower prob- 
abilities, P_ B is the appropriate model for the piece of information that l X assumes a value 
infi' and nothing more: any other coherent lower prevision P that satisfies P(B) = 1 domi- 
nates P B , and therefore represents stronger behavioural dispositions than those required by 
coherence and this piece of information alone. Also observe that 

ext(M(P B )) = {P c :xGB}, 

where P x is the (degenerate) linear prevision on £(X) all of whose probability mass lies in 
x, defined by P x (f ) — f(x) for all gambles / on X. P B is therefore the lower envelope of 
this set of (degenerate) linear previsions, as is also apparent from Eq. (2). 



We only consider the topology of point- wise convergence on CP(X). If we identify linear previsions with their 
mass functions, which can in turn be identified with elements of the unit simplex in M", where n is the cardinality 
of X, this topology is also the relativisation to this unit simplex of the usual Euclidean (metric) topology on W . 
9 Since M(P) is convex and closed, this infimum is actually achieved, and it can be replaced by a minimum. 
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2.5. Marginal lower previsions. Now consider another random variable Y that may as- 
sume values in a finite set y. A coherent lower prevision P on £(X x V) is a model for 
a subject's uncertainty about the values that the joint random variable (X,Y) assumes in 
X x y. We can associate with P the so-called marginal lower prevision P Y on£(y), defined 
as follows: 

P.Y(g)=P(g') 

for all g G £(y), where the gamble g' on X x y is defined by g'(x,y) = g(y) for all (x,y) G 
X x y. In what follows, we shall identify g and g', and simply write P(g) rather than 
The marginal P x on £(X) is defined similarly. 

The marginal P Y is the corresponding model for the subject's uncertainty about the 
value that Y assumes in y, irrespective of what value X assumes in X. 

If P is in particular a linear prevision, its marginal Py is a linear prevision too, and its 
mass function py is given by the well-known formula 

p Y (y)=P(Xx{y})= J>(jc,;y). 

2.6. Conditional lower previsions and separate coherence. Consider any gamble h on 
X x y and any value y G y. A subject's conditional lower prevision P(h\Y — y), also 
denoted as P(h\y), is the highest real number p for which the subject would buy the gamble 
h for any price strictly lower than p, if he knew in addition that the variable Y assumes the 
value y (and nothing more!). 

We shall denote by P(h\Y) the gamble on y that assumes the value P(h\Y = y) = P(h\y) 
iny G y. We can for the purposes of this paper assume that P(h\Y) is defined for all gambles 
h on X x y, and we call P( ■ \Y) a conditional lower prevision on £(X x y ). Observe that 
P( ■ \Y) maps any gamble h on X x y to the gamble on y . 

Conditional lower previsions should of course also satisfy certain rationality criteria. 
P( ■ \Y) is called separately coherent if for all y G y, P( ■ |y) is a coherent lower prevision 
on £(X x y), and if moreover P(X x {y}|y) = 1. This last condition is natural since it 
simply expresses that if the subject knew that Y = y, he would be disposed to bet at all 
non-trivial odds on the event that Y = y. 

It is a consequence of separate coherence that for all h in £(X x y) and all y G y, 

P(h\y) =P(h(-, y)\y). 

This implies that a separately coherent P( ■ \Y) is completely determined by the values 
P(f\Y) that it assumes in the gambles / on X alone. We shall use this very useful property 
repeatedly throughout the paper. 

2.7. Joint coherence and the Generalised Bayes Rule. If besides the (separately co- 
herent) conditional lower prevision P( - \Y) on £(X x y), the subject has also specified a 
coherent (unconditional) lower prevision P on £(X x y), then P and P( ■ \Y) should in ad- 
dition satisfy the consistency criterion of joint coherence. This criterion is discussed and 
motivated at great length in [37, Chapter 6] . For our present purposes, it suffices to mention 
that P and P( ■ \Y) are jointly coherent if and only if 

P{hx{y}[h-P{h\y)}) = for all y G y and all h G £(X x y). (GBR) 

If P is a linear prevision P, this can be rewritten as P{hlx x { y }) = P{h\y)P(^X x {y}), and if 
Pyiy) — ^¥({y}) = ^(3C x {y}) > it follows that P( ■ \y) is the precise (linear) prevision 
given by Bayes' rule: 

P(hhx{y}) 



p{h\y)=P{h\y) 



P(Xx{y})' 
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or equivalently, in terms of mass functions: if py(y) > then p(x\y) = p(x,y) / py{y)- For 
this reason, the joint coherence condition given above is also called the Generalised Bayes 
Rule (GBR, for short). It can be shown [37, Theorem 6.4.1] that if P(X x {y}) > 0, then 
P(h\y) is uniquely determined by this condition, or in other words: it is the unique solution 
of the following equation in jj,: 

P(hx{y}[h-Li}) = 0. 

Equivalently, we then have that 

£(%) = inf | : P 6 M(fl 

i.e., the uniquely coherent conditional lower prevision is obtained by applying Bayes' rule 
to every linear prevision in M(P), and then taking the lower envelope. For this reason, this 
procedure for obtaining a conditional from a joint lower prevision is also called divisive 
conditioning by Seidenfeld et al. [17, 32]. 

2.8. Natural and regular extension. If P(X x {y}) > 0, then the conditional lower pre- 
vision P( ■ \y) is uniquely determined by the unconditional lower prevision P. But this is 
no longer necessarily the case if P(X x {y}) = (something similar holds in the Bayesian 
theory for precise previsions P if py(y) = P(X x {y}) = 0). The smallest, or most con- 
servative, conditional lower prevision E_( ■ \Y) that is jointly coherent with the joint lower 
prevision P is called the natural extension of P to a conditional lower prevision. For any 
gamble ft on X x y and y in V, it is uniquely determined by the GBR if P(X x {y}) > 0, 
and by 

E(h\y)=mmh(x,y) 

xEX 

if P(X x {>■}) = 0, i.e., E( ■ \y) is then the vacuous lower prevision relative to the set X x 

M- 

In certain cases, it may be felt that natural extension is too conservative when P(X x 
{>■}) = 0. The following procedure, called regular extension, allows us to associate with 
any coherent lower prevision P on L(X x V) another (separately coherent) conditional 
lower prevision R( ■ \Y) that is jointly coherent with P: 

(RE1) if P(X x {y}) > 0, then R(h\y) is the greatest solution of the following inequality 
in jj, : 

P(hx{y}[h-H])>0; 
(RE2) if P(X x {>■}) = 0, then R( ■ \y) is the vacuous lower prevision relative to X x {y}: 

R(h\y) = minh(x,y); 

where h is any gamble on X x y. Regular extension coincides with natural extension un- 
less P(X x {y}) = and P(X x {y}) > 0, in which case natural extension is vacuous and 
regular extension can be much less conservative. We shall see examples of this in the 
following sections. The regular extension R( - \Y) is the smallest, or most conservative, 
conditional lower prevision that is coherent with the joint P and satisfies an additional reg- 
ularity condition. It is the appropriate conditioning rule to use if a subject accepts precisely 
those gambles h for which P{h) > and P(h) > (see [37, Appendix J] for more details). 
It is especially interesting because it has a nice interpretation in terms of sets of linear 
previsions: if P(X x {y}) > it can be shown quite easily that 

my) = inf { p(XxM) : P e M(£) and P(X x {y}) > 
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Thus, R(h\y) can be obtained by applying Bayes' rule (whenever possible) to the precise 
previsions in M(P), and then taking the infimum. Regular extension therefore seems the 
right way to update lower previsions on the Bayesian sensitivity analysis interpretation as 
well. It has been called Bayesian updating of coherent lower previsions by for instance 
Jaffray [18]. Regular extension is also used for updating in one of the more successful im- 
precise probability models, namely Walley's Imprecise Dirichlet Model [38], where using 
natural extension would lead to completely vacuous inferences. Also see [5, 10, 36, 37, 39] 
for more information about this type of updating. 

2.9. Marginal extension. It may also happen that besides a (separately coherent) condi- 
tional lower prevision P(- \Y) on £(X x y) (or equivalently, through separate coherence, 
on £(X)), we also have a coherent marginal lower prevision P Y on XL (y ) modelling the 
available information about the value that Y assumes in ^. 

We can then ask ourselves whether there exists a coherent lower prevision P on all of 
£(X x that (i) has marginal P Y , and (ii) is jointly coherent with £(• It turns out that 
this is always possible. In fact, we have the following general theorem (a special case of 
[37, Theorem 6.7.2]), which is easily proved using the results in the discussion above. 

Theorem 1 (Marginal extension theorem). Let P Y be a coherent lower prevision on 
and let P( - \Y) be a separately coherent conditional lower prevision on £(X x y). Then 
the smallest (most conservative) coherent lower prevision on £(X x ^) that has marginal 
P_ Y and that is jointly coherent with P( ■ \ Y) is given by 

P(h)=P Y (P(h\Y)) (3) 

for all gambles honXx^. 

For a linear marginal Py and a conditional linear prevision P( ■ \Y), we again recover well- 
known results: the marginal extension is the linear prevision P = Py(P( ■ \Y))- In terms of 
mass functions, the marginal extension of the marginal py{y) and the conditional p(y\x) is 
given by p(x,y) — p{x\y)pr{y)- Walley has shown [37, Section 6.7] that marginal extension 
also has a natural Bayesian sensitivity analysis interpretation in terms of sets of linear 
previsions: for any gamble h on X x y, we have that 

P(h)=P Y (P(h\Y)) 

= M{Py(P(h\Y)): P Y e M(P Y ) and (Vy e y)(P(- b) e M(P(- |y)))} . (4) 

The marginal extension of P Y and P(-\Y) can in other words be obtained by forming the 
marginal extension for their compatible, dominating linear previsions, and then taking the 
infimum. In this infimum, the sets M(P Y ) and M(P( • \y)) can be replaced by their sets of 
extreme points. 

2.10. Decision making. Suppose we have two actions a and b, whose outcome depends 
on the actual value that the variable X assumes in X. Let us denote by the gamble on 
X representing the uncertain utility resulting from action a: a subject who takes action a 
receives f a (x) units of utility if the value of X turns out to be x. Similar remarks hold for 
the gamble fi,. 

If the subject is uncertain about the value of X, it is not immediately clear which of the 
two actions he should prefer. 10 But let us assume that he has modelled his uncertainty by a 
coherent lower prevision P on L (X) . Then he strictly prefers action a to action b, which we 
denote as a > b, if he is willing to pay some strictly positive amount in order to exchange 



10 Unless /„ point-wise dominates fi, or vice versa, which we shall assume is not the case. 
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the (uncertain) rewards of b for those of a. Using the behavioural definition of the lower 
prevision P, this can be written as 

a>b^P(f a -f b )>0. (5) 

If P is a linear prevision P, this is equivalent to P{f a ) > P(fb)'- tne subject strictly prefers 
the action with the highest expected utility. It is easy to see that P(f a — fb) > can also be 
written as 

(VP£M(P))(P(fa)>P(fb))- 
In other words, a > b if and only if action a yields a higher expected utility than b for 
every linear prevision compatible with the subject's model P. This means that > also 
has a reasonable Bayesian sensitivity analysis interpretation. We shall say that a subject 
marginally prefers a over b if P(f a — fb) > 0, i.e., when he is willing to exchange f b for f a 
in return for any strictly positive amount of utility. 

If we now have some finite set of actions K, and an associated set of uncertain rewards 
{f a : a £ K}, then it follows from the coherence of the lower prevision P that the binary 
relation > on K is a strict partial order, i.e., it is transitive and irreflexive. Optimal actions 
a are those elements of K that are undominated, i.e., to which no other actions b in K are 
strictly preferred: (\/b £ K)(b ^ a), or equivalently, after some manipulations, 

(Vb£K)(P(f a -f b )>0). 

We shall call such actions P-maximal (in K). If P is a linear prevision P, the P-maximal 
actions are simply those actions a in K with the highest expected utility P{f a ). 

Two actions a and b are called equivalent to a subject, which we denote as a ~ b, if he 
is disposed to (marginally) exchange any of them for the other, i.e., if both P(f a — fb) > 
an d Eifb — fa) > 0, or equivalently, 

a^b^P{f a - f b ) = P(f a -f„)= P(f„ - f a ) = P(f b -f a )=0. 

When P is a linear prevision P, this happens precisely when P(f a ) = P(fb), i- e -, when both 
actions have the same expected utility. 

When P is imprecise, two actions a and b may be incomparable: they are neither 
equivalent, nor is either action strictly preferred over the other. This happens when both 
P(f a —fb) < w ^Eifb — fa) <0and atleastone of these inequalities is strict. This means 
that the subject has no preference (not even a marginal one) for one action over the other; 
he is undecided. Note that this cannot happen for precise previsions. 

Any two P-maximal actions are either equivalent (they always are when P is precise), 
or incomparable, meaning that the information present in the model P does not allow the 
subject to choose between them. It is an essential feature of imprecise probability models 
that they allow for this kind of indecision. 

3. Incomplete observations 

We are now ready to describe our basic model for dealing with incomplete observations. 
It is a general model that describes a situation where we want to measure, or determine, the 
value of a certain variable X, but for some reason can do so only in an imperfect manner: 
we perform some kind of measurement whose outcome is O, but this does not allow us to 
completely determine the value of X. 

Let us give a few concrete examples to make this more clear. Suppose we want to 
measure the voltage (X) across a resistor, but the read-out (O) of our digital voltage meter 
rounds this voltage to the next millivolt (mV). So if, say, we read that O = 12mV, we only 
know that the voltage X belongs to the interval (1 lmV, 12mV]. 
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In the example in the Introduction, X = A is the result of the medical test. If we know 
the result x of the test, then we say that we observe O = x. But if the test result is missing, 
we could indicate this by saying that O = * (or any other symbol to denote that we do not 
get a test result or 1). In that case, we only know that X belongs to the set {0,1}. 

In the well-known three-prisoner problem, three prisoners a, b and c are waiting to be 
executed when it is decided that one of them, chosen randomly, is to be set free. The warden 
tells prisoner a the name of one of the other two convicts, who has not been reprieved. The 
question is then if what the warden tells a gives him more information about whether he 
will be executed or not. This can also be seen as a case of an incomplete observation: the 
variable X identifies which prisoner is to be reprieved, and the observation O is what the 
warden tells prisoner a. If for instance a is reprieved, then the warden will name either b 
or c: we then know that O can take any value in the set {b,c}. Conversely, if the warden 
names prisoner b, so O — b, then all we know is that the variable X can take any value in 
{a,c}, so again X is not completely determined by the observation O. We shall see other 
concrete examples further in this section as well as in the next section. 

Let us now present a formal mathematical model that represents the features that are 
common to problems of this type. We consider a random variable X that may assume 
values in a finite set X. Suppose that we have some model for the available information 
about what value X will assume in X, which takes the form of a coherent lower prevision 
Po defined on £(X). 

We now receive additional information about the value of X by observing the value that 
another random variable O (the observation) assumes in a finite set of possible values 0. 
Only, these observations are incomplete in the following sense: the value of O does not 
allow us to identify the value of X uniquely. In fact, the only information we have about 
the relationship between X and O is the following: if we know that X assumes the value 
x in X, then we know that O must assume a value o in a non-empty subset T(x) of 0, 
and nothing more. This idea of modelling incomplete observations through a so-called 
multi-valued map T essentially goes back to Strassen [35]. 

If we observe the value o of O, then we know something more about X: it can then only 
assume values in the set 

{o}* = {xeX: oer(x)} 

of those values of X that may produce the observation O = o. We shall henceforth assume 
that {o}* ^ for all o G 0: observations o for which {o}* = 0, cannot be produced by any x 
in X, and they can therefore be eliminated from the set without any further consequences. 

Unless {o}* is a singleton, the observation O = o does not allow us to identify a unique 
value for X; it only allows us to restrict the possible values of X to {o}*. This is even the 
case if there is some possible value of X for which o is the only compatible observation, 
i.e., if the set 

W, = {iel: r(x) = {o}} 

is non-empty: the set {o}* includes {o}* and may still contain more than one element. 

The question we want to answer in this section, then, is how we can use this new piece 
of information that O = o to coherently update the prior lower prevision P Q on £(X) to a 
posterior lower prevision P( • \0 = o) = P( ■ \o) on £(X). 

In order to do this, we need to model the available information about the relationship 
between X and O, i.e., about the so-called incompleteness mechanism that turns the values 
of X into their incomplete observations O. In the special case that the marginal £o is a (pre- 
cise) linear prevision Pq (with mass function po), it is often assumed that this mechanism 



UPDATING BELIEFS WITH INCOMPLETE OBSERVATIONS 



13 



obeys the CAR condition, mentioned in the Introduction: 

p(o\x) = p(o\y) >0 



(CAR) 



for all o G and all x and y in {o}* such that po(x) > and po(y) > (see [13, 14] 
for an extensive discussion and detailed references). It is in other words assumed that 
the probability of observing O = o is not affected by the specific values x of X that may 
actually lead to this observation o. After a few manipulations involving Bayes' rule, we 
derive from the CAR assumption that quite simply 



This means that if we make the CAR assumption about the incompleteness mechanism, 
then using the so-called naive updating rule (6) is justified. 

For imprecise priors Pq, this result can be generalised as follows for observations o such 
thatP ({o}*) > 0. Observe that Theorem 2 has an immediate Bayesian sensitivity analysis 
interpretation. 

Theorem 2. Assume that p{o\x) — p{o\y) > for alio G and all x and y in {o}* such that 
Po({x}) > and Po({y}) > 0. Let o G be such that Pq({o}*) > 0. Then the conditional 
lower prevision P( • \o) is uniquely determined by coherence, and given by 



for all gambles f on X. 

Proof. Let N — {x G X: Pq({x}) = 0}. Then it follows from the coherence of P Q that 
Pq(N) = 0. Moreover, for any gamble / on X, it follows from the coherence of P Q that 
£o(/) =£o(/^coA'): £o(/) only depends on the values that / assumes outside N. Moreover, 
our generalised CAR assumption identifies, for all x outside N, a conditional linear previ- 
sion P( ■ \x) on £(0), and hence, by separate coherence, onL(IxO). We may therefore 
write, with some abuse of notation, 11 for the marginal extension P of P and P( ■ \X): 



for all gambles h on X x 0. It follows from coherence arguments (see [37, Section 6.7.3]) 
that P is the only joint lower prevision with marginal P that is jointly coherent with 
P( - \X). It also follows readily from the generalised CAR assumption that for the con- 
ditional mass function, p(o\x) = L I{ }*(x) for all x outside N, where L () is some strictly 
positive real number that only depends on o, not on x. Consequently, 



where the inequality follows from the assumptions. It now follows from the discussion in 
Sections 2.7 and 2.8 that P(-\o) is uniquely determined from the joint P by coherence, and 
given by 



The abuse consists in assuming that the conditional lower previsions P( ■ \x) are linear also for x in N, which 
we can do because we have just shown that the value of the marginal extension does not depend on them. 




(6) 




P(h)=P (P(h\X)), 



P{Xx{o})=P^{p{o\X))=P o {L o I {o y)=L o P ({o}*)>0, 
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for all gambles / on X. The proof is complete if we consider that for all P G M(Pq), 
P(N) = 0, whence with obvious notations, also using separate coherence, 

P(P(fhx{o}\X)) = E P(*Whx{o}\x) = E P(x)P(f(x)I {o} \x) 

xex\N xex\N 
= E P( x )f( x )p(°\ x ) = E pW/WVwW = L oP{fi{ y), 

xeX\N xeX\N 

and similarly 

P(P(X x {o}\X))=P(p(o\X))=L P({ y) > 0, 
where the inequality follows from P({o}*) > P({o}*) > 0. □ 

However, Griinwald and Halpern [14] have argued convincingly that CAR is a very 
strong assumption, which will only be justified in very special cases. 

Here, we want to refrain from making such unwarranted assumptions in general: we 
want to find out what can be said about the posterior £( • \0) if no assumptions are made 
about the incompleteness mechanism, apart from those present in the definition of the 
multi-valued map F given above. This implies that anyone making additional assumptions 
(such as CAR) about the incompleteness mechanism will find results that are compatible 
but stronger, i.e., will find a posterior (lower) prevision that will point-wise dominate ours. 

We proceed as follows. We have argued in Section 2.4 that the appropriate model for the 
piece of information that '0 assumes a value in r(x)' is the vacuous lower prevision P_r( x ) 
on £(0) relative to the set T(x). This means that we can model the relationship between 
X and O through the following (vacuous) conditional lower prevision P( - \X) on £(0), 
defined by 

P(g\*)=P-nx)(8)= min M (7) 

for any gamble g on 0. We have argued in Section 2.6 that there is a unique separately 
coherent conditional lower prevision that extends this to gambles on the space DC x 0: for 
any gamble h in £(X x 0), 

P(h\x) = min h(x,o). (8) 

oer(x) 

Eq. (7) also has an interesting Bayesian sensitivity analysis interpretation. The coherent 
lower prevision P( ■ \x) is the lower envelope of the set 

M(P(-\x)) = {P(-\x): P(r(x)\x) = l} 

of all linear previsions on £(0) that assign probability one to the event T(x), i.e., for 
which it is certain that O G On the Bayesian sensitivity analysis interpretation, each 
such linear prevision P( ■ \x) represents a so-called random incompleteness mechanism (or 
a protocol, in Shafer's terminology [33]): a random mechanism that chooses an incomplete 
observation o from the set T(x) of observations compatible with state x, with probability 
p(o\x). The set M(P( • |x)) contains all possible such random incompleteness mechanisms, 
and its lower envelope P( ■ \x) models that we have no information at all about which ran- 
dom incompleteness mechanism is active. 

Using Walley's marginal extension theorem (see Theorem 1 in Section 2.9), the smallest 
(unconditional) lower prevision P on £(X x 0) that extends P and is jointly coherent with 
the conditional lower prevision P( ■ \X) is given by 

P(h)=P (P(h\X)) 
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for all gambles ZionlxO. 12 In order to find the posterior lower prevision, we can now 
apply the technique of regular extension, discussed in Section 2.8. It yields the smallest 
(most conservative) posterior lower prevision R( ■ \0) that is jointly coherent with P (and 
therefore with P and P(- |X)) and satisfies an additional regularity condition. We have 
argued in Sections 2.8 and 2.9 that it also seems the right way to obtain a posterior lower 
prevision on the Bayesian sensitivity analysis interpretation. 

Theorem 3. Let oeO and let f be any gamble on X. If Pq({o}*) > 0, then 

R(f\o) = max { ju : P (/{*}, max{/ -£1,0} + I {o} , min{/ - p , 0}) > 0} . 

IfP({o}*) = then R(f\o) = mm xeX f(x). 

Proof. The discussion in Section 2.8 tells us to look at the value of P(X x {o}) = Pq(P(X x 
{o}) \X). Observe that for any x E X, by Eq. (8), 

P(X x {o}\x) = max I Xx{o} (x,p) = I {o} *{x), 

whence P(X x {o})\X)=I {o} , and consequently P(X x {o}) =P ({o}*). IfP(Xx {o}) = 
Pq({o}*) — then the discussion in Section 2.8 tells us that R( ■ \o) is indeed the vacuous 
lower prevision on L(X) (relative to the set X). If P(X x {o}) = Pq({o}*) > 0, then we 
know that, by definition, R(f\o) is the greatest solution of the following inequality in jj,: 

P CxxwLf-M]) >0. 

But for any x E X, we find that 

P{hx{o}\f ~ M]W = min Ixx{o}(x,p)[f(x)-n] 
peY(x) 

'f(x)-pL ifxe{o}* 
min{0,/(x) -/i} if x E {o}* andx ^ {o}* 
k ifx^{o}* 
= I{o}, W max{/ (x) - ll , 0} + I {o} , (x) min{/(x) - jU , 0} , 

whence indeed 

P {hx{o} \f ~ M]) = Bo (ho}, max (/ - M . 0} + I{o}* min{/ - y,, 0}) . 
This concludes the proof. □ 

It also follows from this proof and the discussion in Section 2.8, that the natural — as op- 
posed to the regular — extension E_{ - \o) is vacuous whenever P(Xx {o}) =£o({°}*) = 0, 
and that E_{h\o) is the unique solution of the equation 

P o max{/ - jj, , 0} + / {o} . min{/ - jU , 0}) = 

in jx whenever £o({°}*) > ( m which case regular and natural extension coincide). We 
shall see later that there are interesting cases where {o}* is empty, and where the natural 
extension E_{ ■ \o) is therefore the vacuous lower prevision relative to X. But this seems 
needlessly imprecise, as we know from the observation O = o that X should belong to the 
set {o}* of those values that can produce the observation o, which may be a proper subset 
of X. We shall see in Theorem 4 that regular extension produces results that are more 
intuitively acceptable in this respect. 

Let us now apply the results of Theorem 3 to a puzzle of some standing in probability 
theory: the Monty Hall puzzle (see for instance [14] for further discussion and references). 

lz, See [27] for a more general discussion with more mathematical detail. 
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We mention in passing that it is very closely related to the three prisoners problem, intro- 
duced at the beginning of the section, an that it can be dealt with in an almost identical 
manner. 

The Monty Hall puzzle. In the Monty Hall game show, there are three doors. One of 
these doors leads to a car, and the remaining doors each have a goat behind them. You 
indicate one door, and the show's host — let us call him Monty — now opens one of the 
other doors, which has a goat behind it. After this observation, should you choose to open 
the door that is left, rather than the one you indicated initially? 

To solve the puzzle, we reformulate it using our language of incomplete observations. 
Label the doors from 1 to 3, and assume without loss of generality that you picked door 1. 
Let the variable X refer to the door hiding the car, then clearly X = {1,2,3}. Observe that 
there is aprecise prior prevision Pq determined by Po({l}) =^b({2}) — Pq{{3}) = h. The 
observation variable O refers to the door that Monty opens, and consequently = {2,3} 
is the set of doors Monty can open. If the car is behind door 1, Monty can choose between 
opening doors 2 and 3, so T(l) = {2,3}, and similarly, T(2) = {3} and T(3) = {2}. Since 
we know nothing at all about how Monty will choose between the options open to him, 
we should model the available information about the relation between X and O by the 
conditional lower prevision P( ■ \X) given by Eq. (8): for any gamble h on X x 0, 

P(/*|l)=min{ft(l,2),/j(l,3)}, P{h\2) = h(2,3), P(h\3) = h(3,2). 

Applying the marginal extension theorem to the marginal Pq and the conditional lower 
prevision P( ■ \X), we find the following joint lower prevision P on £(X x 0): 

P(h) = imin{A(l,2),/»(l,3)} + i/i(2,3) + l/i(3,2), 

for all gambles h on X x 0. 

Assume without loss of generality that Monty opens door 2. What can we say about the 
updated lower prevision R(f\2) when / is any gamble on X? Since P(X x {2}) = j > 0, 
we can use the GBR to find the (uniquely!) coherent R{f\2) as the unique solution of the 
following equation in jj,: 

L(h x {2} [/ - At] ) = I min{/(l ) - M , 0} + \ [/(3) - m] = 0. 
It is easy to see that 

^(/|2) = i/(3) + imin{/(3),/(l)}. 

We are now ready to solve the puzzle. Which of the two actions should we choose: stick 
to our initial choice and open door 1 (action a), or open door 3 instead (action b). In 
Table 1 we see the possible outcomes of each action for the three possible values of X. If 





1 


2 


3 


a 


car 


goat 


goat 


b 


goat 


goat 


car 


fb-fa 


-A 





A 



Table 1 . Possible outcomes in the Monty hall puzzle 

the gamble f a on X represents the uncertain utility received from action a, and similarly 
for fj,, then we are interested in the gamble fa — f a , which represents the uncertain utility 
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from exchanging action a for action b. The possible values for this gamble are also given 
in Table 1, where A denotes the difference in utility between a car and a goat, which is 
assumed to be strictly positive. Then we find that 

Eifb -f a \2)= 1 -A+ 1 - min{A, -A} = 

and 

R{fa-f b \2) = -\^ + \ min{A, -A} = -A. 

This implies that, with the notions and notations established in Section 2.10, a~j> b, b ^ a, 
and atfib: the available information does not allow us to say which of the two actions, 
sticking to door 1 (action a) or choosing door 3 (action b), is to be strictly preferred; 
and neither are these actions equivalent. They are incomparable, and we should remain 
undecided on the basis of the information available in the formulation of the puzzle. 

The same conclusion can also be reached in the following way. Suppose first that Monty 
has decided on beforehand to always open door 3 when the car is behind door 1 . Since he 
has actually opened door 2, the car cannot be behind door 1 , and it must therefore be behind 
door 3. In this case, action b is clearly strictly preferable to action a. Next, suppose that 
Monty has decided on beforehand to always open door 2 when the car is behind door 1 . 
Since he actually opens door 2, there are two equally likely possibilities, namely that the 
car is behind door 1 or behind door 3. Both actions a and b now have the same expected 
utility (zero), and none of them is therefore strictly preferable to the other. Since both 
possibilities are consistent with the available information, we cannot infer any (robust) 
strict preference of one action over the other. A similar analysis was made by Halpern 
[15]. 

Observe that since R(fb — f a \2) = 0, you almost-prefer b to a, in the sense that you 
are disposed to exchange f a for in return for any strictly positive amount. In the 
slightly more involved case that Monty could also decide not to open any door (denote 
this observation by 0), we now have = {0,2,3}, T(l) = {0,2,3}, T(2) = {0,3} and 
T(3) = {0,2}. Consequently, {2}* = and {2}* = {1,3}, and a similar analysis as before 
(see in particular Theorem 4 below) tells us that the updated lower prevision is given by 
R{f\2) = min{/(l),/(3)}, and we get R{f h -f a \2) = R(f a -f h \2) = -A: now neither 
option is even almost-preferred, let alone strictly preferred, over the other. 

When naive updating is justified. We are now in a position to take a closer look at the 
issue of when using the naive updating rule (6) can be justified, even if nothing is known 
about the incompleteness mechanism. 

We start with a precise prior prevision Pq on £(X) and consider an incomplete obser- 
vation o e 0. We shall assume that {o}* is non-empty 13 and that the mass function po 
is strictly positive on all elements of {o}*. In this case, it follows from the discussion in 
Section 2.7 and the proof of Theorem 3 that the posterior lower prevision after observing 
o is uniquely determined by coherence, and equal to the regular extension R( ■ \o). 

We shall see from the following discussion that using the naive posterior Pq( ■ \{o}*) is 
still justified, even if we know nothing at all about the incompleteness mechanism, if and 
only if 

{o}* = {o}*, (NAIVE-OK) 
i.e., if all the states that may produce observation o can only produce observation o. 

' 3 If {o}. t = then the vacuous lower prevision P( ■ |o) relative to X is coherent with the joint P, and naive 
updating will not be justified, as it produces a precise posterior. 



18 



GERT DE COOMAN AND MARCO ZAFFALON 



First of all, if (NAIVE-OK) holds, it follows immediately from Theorem 3 and the 
assumptions that 

R(f\o) = ^^Y=p (f\{on 

indeed yielding the same result as naive updating does (see Eq. (6)). 

We now show that (NAIVE-OK) is also necessary. If our regular extension (and there- 
fore coherence) produces the same result as naive updating does, this implies that R( ■ \o) 
is a linear prevision. So we have that for any gamble / on X, R(f\o) = —R(—f\o). It 
then follows from Theorem 3, after some elementary manipulations, that for each gamble 
/ there is a unique /i such that 

P (7 {o} , max{/ - ju , 0} + 7 {o} . min{/ - jU, 0}) 

= 7b (7 W , min{/ - ju, 0} + 7 {o} . max{/ - ju, 0}) = 0. 
Let x be any element of {o}*. Choose in particular / = 7{ x j, then it follows that 

p o iko}, %} - M]) = (7 {o} . [7 {x} - jU]) = 0, 

or equivalently 

= Po(x) Po( x ) 
*>({*}.) P ({o}*Y 
whence Po({o}*) = Pq({o}*), since it follows from our assumptions that po(x) > 0. Again, 
since po is assumed to be strictly positive on all elements of {o}*, Eq. (NAIVE-OK) fol- 
lows. 

Observe that if Eq. (NAIVE-OK) holds, then all states x in {o}* can only lead to obser- 
vation o, whence p(o\x) = 1, so the CAR condition is forced to hold, but in a very trivial 
way. In the same vein, it follows from Eq. (NAIVE-OK) and Eq. (8) that for all x in {o}*, 
P-(f\ x ) = /(°)> so £-{ ' l x ) i s a precise conditional prevision, whose mass function satisfies 
p(o\x) = 1 for allx in {o}*. 

Our conclusion is that when the incompleteness mechanism is unknown, naive updating 
is never justified, except in those trivial situations where CAR cannot fail to hold. It is 
striking that Griinwald and Halpern obtain essentially the same conclusion using a rather 
different approach: compare Eq. (NAIVE-OK) to Proposition 4.1 in [14]. 

When an observation is not a necessary consequence. To conclude this general discus- 
sion of incomplete observations, we shall consider an important special case where nearly 
all reference to the prior is obliterated 14 from the posterior: we want to find R{ ■ \o) for an 
observation O = o that is not a necessary consequence of any value of X, i.e., 

H, = {iei:r(i) = H} = i. (Ai) 

We make the additional assumption that each state of the world compatible with observa- 
tion o has positive upper probability, i.e., 

Po({x}) >0foralljce {o}*. (A2) 

Under these conditions the regular extension R( ■ \o) does not depend on the prior £ , and 
only retains the information present in the multi-valued map F, as the following theorem 
states. We also want to observe that using natural rather than regular extension here, would 



14 This is essentially due to the fact that updating requires us to condition on a set with zero lower prior 
probability. Observe that also in the case of precise probabilities, coherence imposes a very weak link between a 
prior and a posterior obtained after observing a set of zero prior probability. See also Section 2.8. 
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lead to a posterior that is vacuous with respect to all of X, which would make us lose even 
the information present in F. 

Theorem 4. If o G satisfies Assumption (Al) and P Q satisfies Assumption (A2), then 
R( ■ \o) is the vacuous lower prevision P{ }* on £(X) relative to {o}*: 

R(f\o)=P {o} *(f)= min f(x) 

for all f in £(X). 

Proof. We apply the results of Theorem 3. Since it follows from Assumption (A2) and the 
coherence of P that Pq({o}*) > 0, we consider the gamble 

fn = I{ }* min{/ - jU , 0} + I {o}t max{/ - jU , 0} = I {o}t min{/ - n , 0} 

on X, where the last equality follows from Assumption (Al). Then, we know that 

R(f\o) = maxjju : P (/„) > 0} = max {jU : P (I {o}t min{/- /i,0}) > 0} . 

Let A = min x . o6 r(jt) f(x) — min xe { y f(x). If jj, < X then /(x) — /i < implies f{x) — X < 
whence x £ {o}*. Consequently f^ is identically zero, whence £o(/m) = ^- Assume 
therefore that n > X. It remains to prove that £o(/|i) < 0. Observe that there is some xo in 
{o}* such that /(xo) = X. If / is constant, and therefore equal to X, on {o}*, we find that 
fli = - [At - A]/{ }*, whence 

P (/M) = -[At-A]P (W*)<0, 

also taking into account that Assumption (A2) implies Pq({o}*) > 0. If / is not constant 
on {<?}*, let x\ be an element of {o}* such that / assumes no values between f(xo) and 
f{x\) on {o}*, and letA ~ {x e {o}* : f(x) — f(x )}- Assume that X < At < f(x\), then 
for all x G {o}* it follows from /(x) < jti that x G Ao and therefore f(x) = f(xo) = X. 
Consequently, = — \}i — X]Ia , whence 

Po(/m) = -[M-A]Po(A )<0, 

since it follows from Assumption (A2) and the coherence of Pq that Po(Aq) > 0. Since 
we can also deduce from the coherence of P that P (/j, ) is non-increasing in , the result 
follows. □ 

It is illustrative to prove this theorem in an alternative manner, using sets of linear previ- 
sions. 

Alternative proof using sets of linear previsions. A selection s for the multi-valued map F 
is a function from X to that associates with each x G X a compatible observation s(x) G 
r(x). Denote by S(F) the set of all possible selections: 

S(F) = {s G X : (Vx G X)(s(x) G T(x))} . 

For any s in S(F), define the conditional linear prevision P s ( ■ \X) on £-(0) by P s ( ■ |x) = 
P s ( x ) for all x G X, where P s ^ is the (degenerate) linear prevision on &(Q) all of whose 
probability mass lies in s(x), defined by P s ( x )(g) — g(s(x)) for all gambles g on 0. Then 
clearly, 

{P s (-\X):seS(F)} 
is precisely the set of all conditional linear previsions P( ■ \X) such that 

P{-\x) eext(M(E(-|jc))) 
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for allx G X, and consequently, following the discussion in Sections 2.8 and 2.9, it is easily 
seen that 



R(f\o) 

Po(Ps(fI%x{o}\ X )) 



inf[; 



: G M(Pq), s G S(F), P (P S (X x {o}|X)) > 



P (P s (Xx{o}\X))' 
Now for any x in X, also using separate coherence, 

P s (Xx{o}\x)=I Xx{o] (x,s{x))=I {o] {s{x))=I s -i {{o}) (x), 

whence Pq(P s (Xx{o}\X))=P q (s- 1 ({o})), where s- 1 ({o}) = {xeX: s(x) = o} C {o}*. 
Similarly, 

Wxx{ }|*) =/W^Xxh(jc,*W) = /(*)/{<,}(*(*)) =/WVHW)W' 
whence Po(P s {fhx{o}\ x )) = p o{ f I s ~i ({«}))■ Consequently, 

R(f\o) = infj ^^ : P G M(P Q ), s G S(T), Po^ 1 (W)) > j 

= inf {Pot/I^ 1 (W)) : Po G M(P ), s G S(T), ft(* _1 (W)) > 0} . (9) 

Now consider any x G {o}*, whence o G Consequently, there is a selection s G S(T) 
such that s(x) = o. Moreover, Assumption (Al) tells us that we can let s(y) ^ o for all 
y^x. Indeed, this is guaranteed if for aWy^x there is some p in T(y) different from o, so 
that we can let s(y) = p. If this condition did not hold, then there would be some y ^ x such 
that p — o for all p G T(y), i.e., F(y) = {o}, whence y G {o}*, which contradicts Assump- 
tion (Al). Now for such s it holds that s~ l ({o}) = {x}, and consequently Pq(s^ 1 (W)) = 
Pq({x}) and Po(/Vi(W)) = /( x ) p o ({-*}) for all P G M(P ). But Assumption (A2) tells 
us that there is at least one Pq in M(P ) for which Pq({x}) > 0, and it therefore follows 
from Eq. (9) that R(f\o) < f(x), and consequently R(f\o) < mm xe { y f(x). To prove the 
converse inequality, use Eq. (9) and observe that for all s G S(T) and Pq G M(P ) such that 

p (.- 1 (W))>o, 

p o(A-i(W)) . . ff \ ^ ■ f, \ 

— ; — , , / 77- > min fix) > min fix), 
Po(s-H{o})) -xes-H{o}) J -xe{or Jy h 

since the left-hand side is some convex combination of the f(x) for x in s~ l {{o}), and 
since s~' ({o}) C {o}*. □ 

The selections s G S(T) in this proof are essentially the deterministic incompleteness 
mechanisms. They model that for any state x, the observation s(x) G T(x) is selected with 
probability one: p s (s(x)\x) = 1. 



4. Missing data in a classification problem 

In order to illustrate the practical implications of our model for the incompleteness 
mechanism, let us show how it can be applied in classification problems, where objects 
have to be assigned to a certain class on the basis of the values of their attributes. 
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The basic classification problem. Let in such a problem G be the set of possible classes 
that we want to assign objects to. Let Ai, . . . , A n be the sets of possible values for the n 
attributes on the basis of which we want to classify the objects. We denote their Cartesian 
product by 

DC X ' ' ' X J\rfl* 

We consider a class variable C, which is a random variable in 6, and attribute variables 
Afc, which are random variables in Ak (k= I,.. .,ri). The n-tuple X = (Ai , . . . ,A n ) is a 
random variable in X, and is called the attributes variable. The available information 
about the relationship between class and attribute variables is specified by a (prior) lower 
prevision Pq on £(C x X), or equivalently, 15 by a marginal lower prevision P on £(X) 
and a conditional lower prevision Pq( ■ \X) on £(C). 

To see how classification is performed, let us first look at the case that P is a linear 
prevision Pq, or equivalently, a precise probability measure. If the attributes variable X 
assumes a value x in X, then the available information about the values of the class variable 
C is given by the conditional linear prevision Pq( ■ \x). If, on the basis of the observed value 
x of the attributes variable X, we decide that some c' in 6 is the right class, then we can see 
this as an action with an uncertain reward f c i, whose value f c t(c) depends on the value c 
that C actually assumes. An optimal class c opt is one that maximises the expected reward 
Po(f c ' \x): Poifcopt \ x ) ^ Poifd \ x ) f° r a U c ' G C- As a common example, if we let f c i = I{ c '\, 
then Po{f c i \x) — po(c'\x), and this procedure associates the most probable class with each 
value x of the attributes. 

How can this be generalised to the more general case that P Q is not a linear prevision? 
If the attributes variable X assumes a value x in X, then the available information about 
the values of the class variable C is given by the conditional lower prevision Pq ( • \x). The 
discussion in Section 2.10 then tells us that the lower prevision P (- \x) induces a strict 
preference > on the set of classes 6 by 

c'>c"^P JO (f c ,-f cll \x)>0. 

An optimal class c op t is now one that is undominated, i.e., such that for all d £ 6: 

?0(/c opt -/c'W>0. 

Observe that this reduces to the previously mentioned maximum expected utility condition 
^M/copt \ x ) > Po(f c ' \ x ) when P_o( • \x) is a precise, or linear, prevision. 

To make this more clear, let us consider a medical domain, where classification is used 
to make a diagnosis. In this case, the classes are possible diseases and each attribute 
variable represents a measure with random outcome. For example, attribute variables might 
represent medical tests, or information about the patient, such as age, gender, life style, 
etc. We can regard the specific instance of the vector of attribute variables for a patient 
as a profile by which we characterise the person under examination. The relationship 
between diseases and profiles is given by a joint mass function on the class and the attribute 
variables. This induces a linear prevision Pq on £(C x X), according to Section 2. A 
diagnosis is then obtained by choosing the most probable disease given, or conditional on, 
a profile. 

In the case of a linear, or precise, Pq( - \x), if there is more than one optimal class, 
all these classes are equivalent, as they have the same expected reward. But as we have 
explained in Section 2.10, this is no longer necessarily so for imprecise Pq(- \x). Among 
the optimal, undominated classes, there may be classes d and c" that are not equivalent but 



'This is, provided that P (e x {x}) > for all x e X. 
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incomparable: the information in P ( • \x) does not allow us to choose between c' and c", 
and for all we know, both are possible candidates for the class that the object is assigned 
to. This implies that if we classify using an imprecise model P ( • \x), the best we can often 
do, is assign a set of possible, optimal classes to an object with attributes x. In our medical 
example, a given profile would then lead to a number of optimal candidate diagnoses, none 
of which is considered to be better than (or even as good as) the others. Classifiers that 
allow for such set- valued classification are called credal classifiers [41]. 

Dealing with missing data. Now it may also happen that for a patient some of the attribute 
variables cannot be measured, i.e., they are missing, e.g., when for some reason a medical 
test cannot be done. In this case the profile is incomplete and we can regard it as the set of 
all the complete profiles that are consistent with it. As the above classification procedure 
needs profiles to be complete, the problem that we are now facing, is how we should update 
our confidence about the possible diseases given a set-profile. 

In more general terms, we observe or measure the value a^ of some of the attribute 
variables A^, but not all of them. If a measurement is lacking for some attribute variable 
Af, it can in principle assume any value in Af. This means that we can associate with any 
attribute variable A^ a so-called observation variable Ok- This is a random variable taking 
values in the set 

O k = A k l){*}, 

whose elements are either the possible values of A k , or a new element * which denotes that 
the measurement of A k is missing. 

Attribute variables A k and their observations O k are linked in the following way: with 
each possible value a k E At of A k there corresponds the following set of corresponding 
possible values for O k '- 

r t W = K,*}co t . (io) 

This models that whatever value a k the attribute variable A^ assumes, there is some mech- 
anism, called the missing data mechanism, that either produces the (exact) observation a k , 
or the observation *, which indicates that a value for A k is missing. For the attributes vari- 
able X we then have that with each possible value x = (a\,...,a n ) there corresponds a set 
of corresponding possible values for the observations variable 0= (0\,. . . ,O n ): 

r(x) = r 1 (a 1 )x-xr (1 (a„)co, 

where = Oi x • • • x 0„. To summarise, we have defined a multi-valued map I": X — > 
p(0), whose interpretation is the following: if the actual value of the attributes variable X 
is x, then due to the fact that, for some reason or another, measurements for some attributes 
may be missing, the observations O must belong to T(x). 

So, in general, we observe some value o = (<?i, . . . ,o n ) of the variable O, where o k is 
either the observed value for the £-th attribute, or * if a value for this attribute is missing. 
In order to perform classification, we therefore need to calculate a coherent updated lower 
prevision P( ■ \0 = o) on £(C). This is what we now set out to do. 

In order to find an appropriate updated lower prevision P(- |o), we need to model the 
available information about the relationship between X and O, i.e., about the missing data 
mechanism that produces incomplete observations O from attribute values X. 

We have arrived at a special case of the model described in the previous section, and 
our so-called missing data mechanism is a particular instance of the incompleteness mech- 
anism described there. In this special case, it is easy to verify that the general CAR as- 
sumption, discussed previously, reduces to what is known in the literature as the MAR as- 
sumption [25]: the probability that values for certain attributes are missing, is not affected 
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by the specific values that these attribute variables assume. MAR finds appropriate justi- 
fication in some statistical applications, e.g., special types of survival analysis. However, 
there is strongly motivated criticism about the unjustified wide use of MAR in statistics, 
and there are well-developed methods based on much weaker assumptions [26]. 

As in the previous section, we want to refrain from making strong assumptions about 
the mechanism that is behind the generation of missing values, apart from what little is 
already implicit in the definition of the multi-valued map F. We have argued before that 
the information in F, i.e., about the relationship between X and O, can be represented by 
the following conditional lower prevision P( ■ \X) on £(X x 0): 

P(h\x) = min h(x,o), (11) 

for all gambles /z on X x and all iel 

We make the following additional irrelevance assumption: for all gambles / on 6, 

P(f\x,o) = Pjo(f\x) for all x G X and o G F(x). (MDI) 

Assumption (MDI) states that, conditional on the attributes variable X, the observations 
variable O is irrelevant to the class, or in other words that the incomplete observations 
o G F(x) can influence our beliefs about the class only indirectly through the value x of 
the attributes variable X. We shall discuss this assumption in more detail at the end of this 
section. 

Summarising, we now have a coherent lower prevision P on L (X), a separately coher- 
ent conditional lower prevision P( ■ \X) on £ (X x 0) , and a separately coherent conditional 
lower prevision P( ■ \X, O) on £(C x X x 0), determined from P ( • \X) through the irrele- 
vance assumption (MDI). 16 We can now apply a generalisation of Walley's Marginal Ex- 
tension Theorem (see Theorem 8 in Appendix A), to find that the smallest coherent lower 
prevision P on L(G x X x 0) that has marginal P and is jointly coherent with P( ■ \X) and 
P(-\X,0), is given by 

P(h)=Po(P(P(h\X,0)\X)), (12) 

for all gambles h on 6 x X x 0. 

We can now use regular extension to obtain the conditional lower prevision R{ ■ \0) on 
■C(C). It yields the smallest (most conservative) posterior lower prevision that is jointly 
coherent with P (and therefore with P , P ( • |X) and P( ■ |X x 0)) and satisfies an additional 
regularity condition. Here too, it leads to the right way to obtain a posterior lower prevision 
on the Bayesian sensitivity analysis interpretation. Again, observe that using natural rather 
than regular extension would lead to a completely vacuous posterior on C. 

Theorem 5 (Conservative updating rule). Assume that the irrelevance assumption (MDI) 
holds. Let o be any element of 0. Then {<?}* = 0. IfPo({x}) > Ofor all x G {o}*, then for 
any gamble f on C: 

R(f\o)= min £q(/W- («) 

x: o€l{x) 

Proof. Consider any x = . . . ,a n ) in X. Since, by Eq. (10), F/ C (ai ( ) = we find 

that r(x) can never be a singleton, whence indeed 

{o}h, = {xgX: r(x) = {o}}=0. 

16 Actually, the irrelevance assumption (MDI) does not determine P( ■ \X, O) completely, but we shall see that 
this is of no consequence for finding the posterior R( ■ \0). 
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In order to calculate the regular extension R(f\o), the discussion in Section 2.8 tells us that 
we need to know the value of P(G x X x {o}). Taking into account separate coherence, we 
find that for all (x,p) in X x 0, 

P(G x X x {o}\x,p) = P(IexXx{o}(- ,x,p)\x,p) = I {o] {p)P{e\x,p) = I {o] {p), 

whence P(C x X x {o}\X, O) = /{„}. Consequently, we find for allx <E X that 

P(P(e x X x {o}\X,0)\x) = max I [o] {p) = j J - /{„}•(*). 

whence P(P(G x X x {o}\X, O) \X) = I {o y, and therefore, by Eq. (12), 

P(CxXx {o})=P (P(P(exXx {o}\X,O)\X)) = P ({o}*) >0, 

where the last inequality follows from the assumptions. Since P(C x X x {o}) > 0, we can 
calculate the regular extension as 

£(/| o )=max{M:£(/exXx{ o} [/-M])>0}. 
Again using separate coherence, we find that for all (x,p) in X x 0, 

t(hxXx{o}[f - n] \x,p) =E(IexXx{o}( -,x,p)\f -H]\x,p) 

= ho} (p)P(f -v\x,p) = ho} [p)[p(f\x,p)-n], 

whence P(I e x Xx ^ [f - ju] \X, O) = I^o} \P(f\ x > O) - ju] . Consequently, we find that for all 
x E X, using Eq. (11) and the irrelevance assumption (MDI), 

P(P(IexXx{o}\f-H]\X,0)\x) 

= min I { o}(p)[P(f\x,p)-Ll} = min I{ }(p)\Po(f\x) - 

per(x) per(x) 

= fmin{0,Po(/|x)-M} ifo€T(x) 
1 otherwise 

= I {or (x)mm{P o (f\x)-H,0}, 

where we used the fact that {o}* = 0. Consequently, P{P(IexXx{o}lf ~ ^]\^iO)\X) = 
h }* min{£ (/|X) - ;U,0}, and therefore, by Eq. (12), 

P(Ie x x x w [/ - M] ) = Po (We x x x w [/ - M] \X, O) \X) ) 

= Po(/ {or min{Po(/|X)-M,0}), 

whence 

£(/|0)=max{M:P(/exXx {o }[/-M])>O} 

= max{ J u: P Q (I {o} , min{P (/|X) - M,0}) > 0} . 

A course of reasoning similar to the one in the proof of Theorem 4 now tells us that indeed 

R(f\o) = min P (f\x) 

[replace the gamble / on X in that proof by the gamble Po(f\X)]. □ 
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The conservative updating rule. Let us now denote by E that part of the attributes vari- 
able X that is instantiated, for which actual values are available. We denote its value by 
e. Let R denote the other part, for whose components values are missing. We shall denote 
the set of its possible values by % and a generic element of that set by r. Observe that for 
every reX, the attributes vector (e,r) is a possible completion of the incomplete obser- 
vation o = (e, *) (with some abuse of notation) to a complete attributes vector. Moreover, 
{o}* = {e} x 31. We deduce from Theorem 5 that the updated lower prevision R( ■ \e, *) is 
then given by 

R{f\e,*)=ramP {f\e,r) (CUR) 

re 32 

for all gambles / on C, provided that Po({(e,r)}) > for all r G ft, which we shall assume 
to be the case. We shall call (CUR) the conservative updating rule. 

We shall discuss the case that P and P ( • \X) are imprecise in Section 7. But let us first, 
for the remainder of this section, and in Sections 5 and 6, assume that P and Pq( • \X) are 
precise. Observe that even in this case, the posterior R( - \e,*) is imprecise. How can we 
use this imprecise posterior to perform classification? We shall only discuss the simplest 
case: we associate a reward function f c = h c \ with each class c in 6, and we look for those 
classes c that are undominated elements of the strict partial order > on C, defined by 

c' >c" oR{I W} -I {c ,, } \e,*) >0 

minP (/{c'} -l{d'}\e,r) > 

(Vr e K)(p (c'\e,r) > Po (c"\e,r)) (14) 

. p (c'\e,r) 
rex po{c"\e,r) 

where we have used (CUR), and where po( - \e,r) denotes the mass function of Pq( - \e,r). 
Since for all r in ft, it is also assumed that po(e, r) > 0, we can apply Bayes' rule to rewrite 
this as 

C '>c''^min4^4>l. (15) 
rex po{c",e,r) 

Eq. (14) is interesting: it tells us that c' > c" if c' is strictly preferred to c" under all the 
possible completions (e,r) of the observed data (e, *), i.e., if the strict preference is robust 
under all these possible completions. 

Classification is then done by assigning an object with observed attributes (e, *) to the 
set of optimal, undominated classes for the strict preference >. Among these optimal 
classes, there may be classes d and c" that are equivalent: 

(Vr e 3l)(po{c'\e,r) = p (c"\e,r)), 

i.e., that are equally probable under all possible completions (e,r) of (e, *). Otherwise 
they are incomparable, which means that po(c'\e,r\) > po(c"\e,ri) for some completion 
(e,n) and po(c'\e,r2) < po(c"\e,r2) for another completion (e,^), where one of these 
inequalities will be strict. For such incomparable classes, the fact that observations are 
missing is responsible for our inability to make a choice between them. 

In the case of the earlier medical example, e denotes the part of the profile that is known 
for a patient and the same incomplete profile can be regarded as the set {(e,r)\r £ ft} of 
complete profiles that are consistent with it. The conservative updating rule tells us that 
in order to update our beliefs on the possible diseases given the incomplete profile, we 
have to consider all the complete profiles consistent with it, which leads us to lower and 
upper probabilities and previsions. As we explained above, this will generally give rise 
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only to partial classifications. That is, in general we shall only be able to exclude some 
of the possible diseases given the evidence. This may lead to the identification of a single 
disease, but only when the conditions justify precision. 

The conservative updating rule is a significant result: it provides us with the correct 
updating rule to use with an unknown incompleteness mechanism; and it shows that ro- 
bust, conservative inference can be achieved by relying only on the original prior model of 
domain uncertainty. 

It also is a conceptually simple rule, as it involves taking all the possible completions 
of the missing attributes. It is not, therefore, very surprising that the use of analogous pro- 
cedures has already been advocated in the context of robust statistical inference (see for 
instance [26, 31, 40]). These focus on the problem of learning a model from an incom- 
plete sample, which is then simply regarded as the set of all the complete samples that are 
consistent with it. But we are not aware of anyone proposing (and justifying) the same 
intuitive principle for updating beliefs when observations are incomplete. Perhaps the re- 
luctance to change firmly entrenched beliefs about the more traditional naive updating has 
played a role in this. In contradistinction with the previous work on learning models, we 
are indeed proposing a new (coherent) rule for updating beliefs. 

Some comments on the irrelevance assumption. Let us end this section with a discus- 
sion of the irrelevance assumption (MDI), but placed in a context more general than clas- 
sification. [Additional technical comments on Assumption (MDI) in the case that P Q and 
£o( • \X) are precise, are given in Appendix B.] 

Assume that we are studying the relation between observations X and conclusions C, 
in the sense that observing the value x of X in X changes our beliefs about which value 
C assumes in 6. Due to some reason, we cannot observe the value of X, but there is an 
incompleteness mechanism that produces an incomplete version O of X. In this general 
context, Assumption (MDI) tells us that if we have a precise observation X = x, then 
the additional knowledge of what incomplete observation O = o is generated by x, will 
not affect our beliefs about the conclusion C. In other words, if we know the value of 
the precise observation, then knowing what incomplete observation it produces, becomes 
completely superfluous. This can be easily reformulated in the more specific context of 
classification discussed above: if we know the value of all the attributes, then knowing that 
some of the attributes fail to be measured will be irrelevant to the classification. 

We feel that this is precisely what characterises problems of missing data, or of incom- 
plete observations: when something that can be missing is actually measured, the problem 
of missing data disappears. Let us consider the opposite case, where the bare fact that an 
attribute is not measured is directly relevant to predicting the class. This fact should then 
become part of the classification model by making a new attribute out of it, and treating it 
accordingly, so that this should not be regarded as a problem of missing information. Stated 
differently, once the model properly includes all the factors that are relevant to predicting 
the class, (MDI) follows naturally. 

Regarding the relationship between assumption CAR/MAR and our irrelevance as- 
sumption (MDI), it is not difficult to prove that if the former is satisfied (even in the case 
of an imprecise prior discussed in Theorem 2) then the latter holds automatically. This is 
not surprising as the CAR/MAR assumption identifies a subset of a much larger class of 
incomplete observation (and missing data) problems, which are characterised in general 
by (MDI). Note, however, that although one implies the other, they do refer to different 
things. In the context of classification, MAR states that any incomplete observation o is 
equally likely to have been produced by all the attribute vectors x that may produce it, i.e., 
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there is no compatible attribute vector x that yields observation o with a higher probability 
p (o \x) than any other compatible attribute vector. MAR therefore says something about the 
mechanism that produces observations o from attribute vectors x, i.e., about the the miss- 
ing data mechanism itself. Our irrelevance condition (MDI), on the other hand, states that 
if we know the attribute vector precisely, then knowing in addition what observation o is 
produced will not affect the classification. In other words, we assume that the classification 
only depends on the attributes, and not on the missing data mechanism. 

CAR/MAR is much stronger than our irrelevance assumption, but it is worth pointing 
out that there are cases where making the MAR assumption is completely justified, and 
where, consequently, our approach leads to results that are much too weak. We give one 
notable example: the case of an attribute that we know is always missing. In this case the 
missing data mechanism clearly satisfies the MAR assumption: the probability of outcome 
* is one, irrespective of the actual value of the attribute. MAR then tells us that we can 
discard this attribute variable, or 'marginalise it out', as is the usual practice. We should 
therefore not apply the conservative updating rule. We advocate using our rule only when 
nothing is known about the incompleteness mechanism, and this clearly is not the case 
here. 

It may useful to extend the discussion to statistical inference, even if, strictly speaking, 
this goes beyond the scope of our present work. In particular, it is well-known (see for in- 
stance [26, Proposition 2. 1]) that the CAR/MAR assumption cannot be tested statistically, 
in the sense that we cannot use incomplete observations to check whether it is reasonable. 
It does not seem to be possible to test Assumption (MDI) either, for essentially the same 
reasons. To understand this, let us, for the sake of simplicity, look at the case of precise 
probabilities: it should be tested whether or not p(c\x,o) = p{c\x) for all classes c (with 
obvious notations). The problem is that the precise observation x is always hidden to us; we 
can only see the incomplete observation o. So in a statistical inference setting only p(c,o) 
and not p(c,x,o) would be accessible via the data, and we would not be able to perform 
the test. Therefore, there appears to exist a fundamental limitation of statistical inference 
in the presence of missing data: the actually observed data seem not to allow us to test 
our assumptions about the missing data mechanism, but nevertheless our inferences rely 
heavily on the specific assumptions that we make about it! This is one of the reasons why 
we are advocating that only those assumptions should be imposed that are weak enough to 
be tenable. On our view, (MDI) is a good candidate. 



5. Classification in expert systems with Bayesian networks 

One popular way of doing classification in complex real-world domains involves using 
Bayesian networks. These are precise probabilistic models defined by a directed acyclic 
graph and a collection of conditional mass functions [29]. 

A generic node Z in the graph is identified with a random variable taking values in a 
finite set Z (we use 'node' and 'variable' interchangeably, and we reserve the same symbol 
for both). Each variable Z holds a collection of conditional mass functions p^ nz , one for 
each possible joint value %z of its direct predecessor nodes (or parents') Ylz- The generic 

conditional mass function p^ Kz assigns the probability Pq({z}\tIz) = Pt>{z\ftz) to a value 
z € Z (we drop the superscript when we refer to actual probabilities.) 
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Figure 2. The 'Asia' Bayesian network. 

Figure 2 displays the well-known example of Bayesian network called 'Asia'. 17 This 
models an artificial medical problem by means of cause-effect relationships between ran- 
dom variables, e.g., S — > C (each variable is denoted for short by the related letter between 
parentheses in Figure 2). The variables are binary and for any given variable, for instance 
V, its two possible values are denoted by v' and v", for the values 'yes' and 'no', respec- 
tively. The conditional probabilities for the variables of the model are reported in Table 2. 



V = v> 


0.01 


S = s' 


0.5 


T = t' 


v' v" 
0.05 0.01 


C = c' 


s' s" 
0.1 0.01 


H = ti 


s' s" 
0.6 0.3 


L = l> 


t'c' t'c" t"c' t"c" 
0.98 0.98 0.98 0.05 


D = d' 


t'c'h' t'c'h" t'c"h' t'c"h" t"c'h' t"c'h" t"c"h' t"c"h" 
0.9 0.7 0.9 0.7 0.9 0.7 0.8 0.1 



TABLE 2. Asia example: probabilities for each variable (first column) 
in the graph conditional on the values of the parent variables 



Bayesian nets satisfy the Markov condition: every variable is stochastically independent 
of its non-descendant non-parents given its parents. Let us consider a generic Bayesian 

17 The network presented here is equivalent to the traditional one, although it is missing a logical OR node. 
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network with nodes C, A\, A n (for consistency with the notation in Section 4). From 
the Markov condition, it follows that the joint mass function po is given by 

n 

p (c,ai,...,a n )=p (c\7ic)Y[Po(ai\nAi) V(c,ai,--- ,a n ) e Cx X, (16) 

where the values of the parent variables are those consistent with (c,a\ . . . ,a n ). Hence, a 
Bayesian network is equivalent to a joint mass function over the variables of the graph. We 
assume that such a joint mass function assigns positive probability to any event. 

Bayesian nets play an important role in the design of expert systems. In this case, 
domain experts are supposed to provide both the qualitative graphical structure and the 
numerical values for the probabilities, thus implicitly defining an overall model of the prior 
uncertainty for the domain of interest. Users can then query the expert system for updating 
the marginal prior probability of C to a posterior probability according to the available 
evidence E = e, i.e., a set of nodes with known values. In the Asia net, one might ask for 
the updated probability of lung cancer (C = c'), given that a patient is a smoker (S = s 1 ) 
and has abnormal X-rays (L = I'), aiming ultimately at making the proper diagnosis for the 
patient. This kind of updating is very useful as it enables users to do classification, along 
the lines given in Section 4. 

On updating probabilities with Bayesian networks. Updating the uncertainty for the 
class variable in a Bayesian net is subject to the considerations concerning incomplete ob- 
servations in the preceding sections, as generally the evidence set E will not contain all the 
attributes. To address this problem, one can assume that MAR holds and correspondingly 
use the naive updating rule to get the posterior po(c\{e} x ft), but we have already pointed 
out that this approach is likely to be problematical in real applications. Nevertheless, as- 
suming MAR seems to be the most popular choice with Bayesian nets and the literature 
presents plenty of algorithmic developments dealing with this case. 

Peot and Shachter [30] are a notable exception. In their paper, they explicitly report that 
"the current practice for modelling missing observations in interactive Bayesian expert 
systems is incorrect." They show this by focusing on the medical domain where there 
exists a systematic (i.e., non-MAR) incompleteness mechanism originated by the user of 
the expert system and also by the patient himself. Indeed, there is a bias in reporting, 
and asking for, symptoms that are present instead of symptoms that are absent; and a bias 
to report, and ask for, urgent symptoms over the others. Peot and Shachter tackle this 
problem by proposing a model of the incompleteness mechanism for the specific situation 
under study. Explicitly modelling the missing data mechanism is in fact another way to 
cope with the problem of incomplete observations, perhaps involving the same Bayesian 
net. The net would then also comprise the nodes 0%, k = l,...,n, for the incomplete 
observations; and the posterior probability of interest would become p(c\o). Unfortunately, 
this approach presents serious practical difficulties. Modelling the mechanism can be as 
complex as modelling the prior uncertainty. Furthermore, it can be argued that in contrast 
with domain knowledge (e.g., medical knowledge), the way information can be accessed 
depends on the particular environment where a system will be used; and this means that 
models of the missing data mechanism will probably not be re-usable, and therefore costly. 

These considerations support adopting a robust approach that can be effectively imple- 
mented, like the one we proposed in Section 4. It is also useful to stress that our approach 
has quite general applicability. The conservative updating rule, for example, is perfectly 
suited to addressing Peot and Shachter's problem, as the biases they deal with are easily 
shown to satisfy the irrelevance condition (MDI). 
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We next develop an algorithm that exploits (CUR) to perform reliable classification with 
Bayesian networks. 



6. An algorithm to classify incomplete evidence with Bayesian 

networks 

In this section we develop an algorithm to perform classification with Bayesian net- 
works by using the conservative updating rule (CUR). As discussed in Section 2.10 and 
later at the end of Section 4, it is important to realise first that conservative updating will 
not always allow two classes to be compared, i.e., (CUR) generally produces only a partial 
order on the classes. 

As a consequence, the classification procedure consists in comparing each pair of classes 
by strict preference (which we shall also call credal dominance, in accordance with [41]) 
and in discarding the dominated ones. The system will then output a set of possible, op- 
timal classes. In the following we address the issue of efficient computation of the credal 
dominance test. Let c' and c" be two classes in 6. We shall use Eq. (15) to test whether c' 
credal-dominates c" . 

Let n' and n" denote values of the parent variables consistent with the completions 
(c',e,r) and (c",e,r), respectively. If a node's parents do not contain C, let % denote the 
value of the parent variables consistent with (e,r). With some abuse of notation, we shall 
treat the vector R of those attributes for which measurements are missing, in the following 
as a set. Furthermore, without loss of generality, let A\,. . . ,A m , m < n, be the children 
(i.e., the direct successor nodes) of C, and K = {l,...,m}. We shall denote C in the 
following also as Ao- For each i = 0, . . . ,m, let FL| = ILi; U {A,}. Consider the functions 
0V x . A . eU + m Aj — > K+ (;' = 0,...,m), with values equal to p (ai\x' A .) / 'po(ai\n'D for 

■* J A: 1 ! 

i e K, and equal to p (c' '\jtc) / Po{c" \nc) for i — 0. We use the symbol jx to denote the 
minima of the <p -functions, in the following way: 



^ ^\ (17) 

Ajen^nR 

Ma,= mm - • iGK. (18) 

Ajen+nR 



Consider the Markov blanket of C, that is, the set of nodes consisting of the parents of C, 
its children, and the parents of the children of C. Denote by B + the union of C with its 
Markov blanket. We shall refer to B + both as a set of nodes and as a subgraph, depending 
on the context. Initially we focus on networks for which B + is singly connected (the overall 
network can still be multiply connected). We have the following result. 

Theorem 6. Consider a Bayesian network with nodes C, A\, . . . , A n , for which B + is singly 
connected. Let c',c" G 6. Then c' credal-dominates c" if and only if ITJIoA'a, > L 
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Proof. Rewrite the minimum in Eq. (15) as follows: 



m . n /?o( c ', e ,r) _ m . n PQ {c'\% c ) MaiK) po(aj\n^) 
res p (c",e,r) rex [p (c"\7l c ) A|po(«iK,.) f^Po (aj\JC A .) 




(19) 



This shows that the variables that do not belong to B + can be discarded in order to test 
credal dominance. Now recall that every function <j> Aj [that is, every ratio in Eq. (19)] de- 
pends only on the variables in IT^. n R. Given that B + is singly connected, we have that 
only <j> Aj depends on the variables in IX|. DR. Let us show the last statement by contradic- 
tion, by assuming that another function <j) Ak (k £ {0, . . . ,m} \ {/}) depends on a variable in 
DR. There are two cases, either the variable in IX^. n R is A; or it is a parent of A,-, say 

U.' 

In the first case, neither A, nor A^ coincide with the class variable C: A, does not coincide 
with C because no ^-function depends on C; in order for <j) Ak to depend on A„ A, must be a 
parent of A^, so A, is not a child of A#, whence A# cannot coincide with C. But A, being a 
parent of A* would create the undirected loop C-Ai-A^-C, making B + multiply connected. 
This case is impossible. 

Consider now the second case when <j> A , depends on U. In this case U must be a parent 
of A*;, besides being a parent of A;. Note that U does not coincide with C because no 
-function depends on C. As before, these conditions imply that B + should be multiply 
connected. In the case that A^ coincides with C, the loop is U-C-Ai-U. If C coincides 
with A;, the loop is U-C-A^-U . When neither A\ nor A, coincide with C, the loop is 
U-Afr-C-Aj-U '. In every case we have a contradiction. 

Since the variables in IT| P\R appear only in the argument of <p Aj , they can be minimised 
out locally to A,, obtaining fj. Aj . (Observe that jj, Aj is a number because only the variables 
in rij. n R are in the argument of <$> Ai .) Then the thesis follows immediately. □ 

Theorem 6 renders the solution of the credal-dominance test very easy when B + is 
singly connected, 18 with overall computational complexity linear in the size of the input, 
i.e., B + (more precisely, the input is the Bayesian network restricted to B + ). It is useful 
to emphasise that the theorem works also for networks in which B + is multiply connected, 
provided that the evidence E = e makes B + become singly connected. Indeed it is well 
known with Bayesian networks that the arcs leaving evidence nodes can be removed while 
preserving the value po{c\e) (c e 6) represented by the network. This result extends to 
credal dominance because it is computed by min re ^[po(c'\e,r) / po(c"\e,r)] and because 
Po(c\e, r) is preserved by dropping the arcs leaving E, for each c G 6 and r eS. 

Now we move to the case that B + is multiply connected, and show how the ideas behind 
the traditional way of dealing with multiply connected networks, called conditioning, can 
be applied here as well. Conditioning [29] works by instantiating a subset of nodes called 
the loop cutset. The removal of the arcs leaving the loop cutset creates a singly connected 
net. The computation is then carried out on the singly connected net as many times as there 
are joint states of the variables in the cutset, and the results are eventually summarised to 
obtain the result related to the multiply connected net. 



This corrects the invalid claim, made in an earlier version of this paper [6], that the complexity is linear for 
all networks. 
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With credal dominance, the situation is analogous. We assume that the arcs leaving 
evidence nodes in B + have been removed, and that a loop cutset is given that opens the 
remaining loops (recall that, according to the above observation, the loops are opened by 
the cutset also where credal dominance is concerned). Call R\ the loop cutset, and let R2 
be the set of nodes such that R = Ri UR2. Rewrite the test of credal dominance as 

p (c'\e,n,r 2 ) 



mm 



mm 

ne0i2 po(c"\e,ri,r2) 



The inner minimisation is computed by Theorem 6 on the graph B + made singly connected 
by dropping the arcs leaving EURi. The outer minimisation is a simple enumeration of 
the states of the loop cutset, which takes exponential time in general. 

From the viewpoint of worst-case computation complexity, the situation is similar to 
the computation of the updating. However, the computation of credal dominance will be 
easier in the cases where B + does not coincide with the entire network. Furthermore, since 
B + can be singly connected even when the network is multiply connected, the computation 
will be linear also on some multiply connected nets. 

An example. Let us consider the Asia net, where we choose C as the class and set the the 
evidence to L — I' and S = s'. We want to test whether c' credal-dominates c". 

Dropping the arcs leaving S, we obtain a new network in which B + is {C,L,D,T,H}. 
B + is multiply connected, and we select {T} as loop cutset. We start by considering the 
case T = /'. We must compute Llo, LIl, and Mc- We have: 

p (d\t',c',h) . f 0.9 0.7 0.1 0.3] , 
Un = mm — — — — - — - = mm < — , — , — , — > = 1 
^ u dev,hexp (d\t',c",h) \ 0.9' 0.7' 0.1 ' 0.3 J 

= Po(l'\t',c>) = 0.98 

Ml p (l'\t',c") 0.98 



Mc 



poWW) 0.1 1 



Po(c"\s') 0.9 9' 
and their product is 1 /9. In the case T = t", we obtain the following values, 



p (d\t",c',h) (0.9 0.7 0.1 

Ll D = min — = mm 



Ml 

Mc = 



deVfieW p (d\t",c",h) { 0.8' 0.1 ' 0.2 ' 

po{l'\t',c') _ 098 _ 98 
p (l'\t',c") ~ O05 ~ T 
Po(c'\s') 0.1 1 



031 _ I 
09J 3 



PoWV) °- 9 9 

with product equal to 98/135 ~ 0.726. The minimum of the products obtained with the 
two values for T is just 1 /9, so that c" is undominated. 

Testing whether c" credal-dominates c' is very similar and leads to 45/686 as the value 
of the test, so c' is undominated as well. In this situation, the system suspends judgement, 
i.e., it outputs both the classes, as there is not enough information to allow us to choose 
between the two. This can be seen also by computing the posterior interval of probability 
for c' by the conservative updating rule, which leads to [0.1,0.934]. The width of this 
interval quantifies the mentioned lack of information. All of this should be contrasted with 
naive updating, which produces po(c'\l',s') ~ 0.646, and leads us to diagnose cancer. 

It is useful to better analyse the reasons for the indeterminate output of the proposed 
system. Given our assumptions, the system cannot exclude that the available evidence is 
part of a more complete piece of evidence where T =t',D = d', and H = h! ' . If this were the 
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case, then c" would be nine times as probable a posteriori as c', and we should diagnose no 
cancer. However, the system cannot exclude either that the more complete evidence would 
be T = t", D = a", and H = h". In this case, the ratio of the posterior probability of c' to 
that of c" would be 686/45, leading us to the opposite diagnosis. 

Of course when the evidence is strong enough, the proposed system does produce de- 
terminate conclusions. For instance, the evidence L — l',S — s' and T — t' will make the 
system exclude the presence of cancer. 

7. Working with credal networks 

Credal networks provide a convenient way of specifying prior knowledge using the 
theory of coherent lower previsions. They extend the formalism of Bayesian networks by 
allowing sets of mass functions [2, 1 1], or equivalently, sets of linear previsions. These are 
also called credal sets after Levi [24]. We recall that a credal set is equivalent to a coherent 
lower prevision, as pointed out in Section 2.3. 

A credal network is a pair composed of a directed acyclic graph and a collection of 
conditional credal sets 19 (i.e., a collection of conditional lower previsions). We intend the 
graph to code strong independences. Two variables Z\ and Z2 are said to be strongly inde- 
pendent when every vertex in the credal set of joint mass functions for [Zx^Zj), satisfies 
stochastic independence of Z\ and Z2. That is, for every extreme mass function p in the 
credal set, and for all the possible pairs (21,22) € Z\ x Z2, it holds that p{z\\z2) — p{z\) 
and p(zi\z\) = p(z2)- 20 Each variable Z in the net holds a collection of conditional lower 
previsions, denoted by P^'" 2 , one for each possible joint value 7tz of the node Z's parents 
Ilz. With some abuse of notation, 21 let M(P^ ) be the credal set of mass functions for 

the linear previsions dominating assigns the probability pq(z\7Zz) 

to a value z G Z. In the following we assume that each of these mass functions assigns 
positive probability to any event. Given the equivalence between lower probability func- 
tions and credal sets, we can regard each node of the net to hold a collection of conditional, 
so-called local, credal sets. Actually, the usual approach of specifying the conditional 
lower previsions for the nodes precisely amounts to providing the local credal sets directly. 
This is commonly done by separately specifying these credal sets [12, 37], something that 
we also assume here: this implies that selecting a mass function from a credal set does 
not influence the possible choices in others. This assumption is natural within a Bayesian 
sensitivity analysis interpretation of credal nets. 

Credal nets satisfy a generalised version of the Markov condition called the strong 
Markov condition: each variable is strongly independent of its non-descendant non-parents 
given its parents. This leads immediately to the definition of the strong extension [3] of a 
credal net. This is the most conservative lower prevision Pq on £(6 x X) that coherently 
extends the nodes' conditional lower previsions, subject to the strong Markov condition. 
Let the nodes of the network be C (i.e., Aq), A\, A n , as before. It is well known that the 
credal set equivalent to P is 

M(Pq) = CH jp factorising as in Eq. (16): p^' e M{^ %Ai ),i = 0, ...,«} , (20) 

19 In this context, as in [2], we restrict ourselves to credal sets with a finite number of extreme points. 
90 

u See also [28] for a complete account of different strong independence concepts and [3] for a deep analysis 

of strong independence. 
21 

In preceding sections, the symbol 3VC was used to denote the dominating set of linear previsions. We use 
the same symbol here as there is one-to-one correspondence between linear previsions and mass functions (see 
Section 2.3). 
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where CH denotes the convex hull operation. In other words, M(Pq) is the convex hull 
of the set of all the joint mass functions that factorise according to Eq. (16), obtained by 
selecting conditional mass functions from the local credal sets of the net in all the possible 
ways. The strong extension is an imprecise prior defined by means of the composition of 
local information. From yet another viewpoint, the credal set M(P ) makes a Bayesian 
sensitivity analysis interpretation of credal nets very natural: working with a credal net 
can equivalently be regarded as working simultaneously with the set of all Bayesian nets 
consistent with M(P ). 

The credal set M(Pq) can have a huge number of extreme mass functions. Indeed, 
the computation of lower and upper probabilities with strong extensions is NP-hard [12] 22 
also when the graph is a polytree. Polytrees are directed acyclic graphs with the charac- 
teristic that forgetting the direction of arcs, the resulting graph has no undirected cycles. 
This should be contrasted with Bayesian networks for which common computations take 
polynomial time with polytrees. Indeed, the difficulty of computation with credal nets has 
severely limited their use so far, even though credal nets have the great advantage over 
Bayesian nets of not requiring the model probabilities to be specified precisely. This is a 
key point for faithfully modelling human knowledge, which also allows expert systems to 
be developed quickly. 

In the following we extend Theorem 6 to credal nets, showing that conservative updating 
allows classification with credal nets to be realised with the same complexity needed for 
Bayesian nets. This appears to be an important result, with implications for the practical 
usability of credal nets in modelling knowledge. 

Below we reuse the definition Yl A given in Section 6, we again denote by B + the union 
of C with its Markov blanket, and we refer to C also by Aq. Consider the following quanti- 
ties: 

c\kc ■ Po{c'\tcc) ,,,,, 

Pol = Mgmm (21) 

and, for each i 6 K, 

PM\n' A )= min PoK'K,) ( 22 ) 

p 'eMGPo ') 
= „ max „ Po(aiK t ), (23) 

P Q 'GMCPo ) 

as well as the functions </> : x .. A . eU + nR Aj — > R + (i = 0, . . . ,m), with values equal to 

i J Aj 

p{ai\n' A ) /p{ai\n'l) for i e K, and equal to po*(c'\nc)/po*(c"\^c) f° r ' = 0. We use the 
symbol jj, to denote the minima of the ^-functions, as follows: 

PQ*(c'\n c ) .... 
jJL. = mm - — y- — '- (24) 



M 4 - min Z u , 1 7' , i€K. (25) 



A } en+nR 



22 

However, it should be observed that Ferreira da Rocha and Cozman's result is proved for the subset of 
polytrees in which the local credal sets are convex hulls of degenerate mass functions that assign all the mass 
to one elementary event. As such, it does not tell us anything about the complexity of working with the case of 
polytrees whose credal sets are made up of mass functions that assign positive probability to any event. 
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We have the following result. 



Theorem 7. Consider a credal net with nodes C, Ay A n , for which B + is singly 
connected. Let c',c" £ 6. Then c' credal-dominates c" if and only if n^LoM^. > 1- 

Proof. A credal net can equivalently be regarded as a set of Bayesian nets, as is apparent 
from Eq. (20). Accordingly, for credal dominance to hold with a credal net, it is necessary 
that it holds for all the joint mass functions consistent with the strong extension. This can 
be tested by solving the following double minimisation problem: 

Po(c',e,r) 



mm mm 



PoeMffi,) rex p (c",e,r) 



- mm 



mm 



mm 



p 'eM(^ Ak ),AjGB+'nR 



po{c'\n c ) j-jPo(a/ 



Po(c"\xc)hxPo(ai\*Af) 



(26) 



(27) 



Po 



A k \x'! A k \n'l 

G^Vt(^0 )' 



mm 



mm 



Po 



mm 
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where the passage from (26) to (27) is due to (19) and (20); 23 and the following passage 
is possible thanks to the characteristic of separate specification of credal sets in the credal 
network. Note that Expression (29) resembles Expression (19) of Theorem 6. In fact, 
the proof of Theorem 6 below Expression (28) applies here as well: (j) depends only 

— Aj 

on the variables in ITj. C\R and only (j> A depends on them. As in Theorem 6, the thesis 
follows immediately since the variables in n^. HR can then be minimised out locally to A,, 



obtaining u 



□ 



Theorem 7 renders the solution of the credal dominance test for credal networks very 
easy when B + is singly connected. However, in order to have a better idea of the computa- 
tional complexity, one has to carefully examine the complexity of solving Problems (21)- 
(23). This is what we set out to do in the following. 

Let again Z be a generic variable in the network. We consider three common ways of 
specifying the local credal sets of the net. 

1 . In the first case, the conditional 24 credal set M,(P^ nz ) for the variable Z is specified via 
linear constraints on the probabilities po(z\7tz), z E Z. That is, in this representation the 
vector of probabilities pq(z\%z), z E Z, can take every value in a closed and bounded 
space described by linear constraints on the variables po(z\7Cz), i-e., in a polytope. 

2. In the second case, we assume that M(£^ z ) is the convex hull of a set of mass func- 
tions directly provided by the modeller. 



23, 



Actually, the passage is also based on the fact that the minimum of (26) is achieved at an extreme point of 
M(P ). This is well-known with credal networks and is pointed out formally by Theorems 5 and 7 in reference 
[11]. 

24 The situation with root nodes is analogous. 
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3. Finally, we consider the case when M(Pq z ) is provided by specifying intervals of 
probability for the elementary events (z\tz z ), z G Z. This is a special case of Case 1 
where the only constraints allowed on the probabilities po{z\n z ) are bounds, except for 
Y,zezPo(z\nz) = 1- Without loss of generality, we assume that the probability intervals 
are reachable [4]. This holds if and only if M(P^ Xz ) is nonempty and the intervals 

are tight, i.e., for each lower and upper bound there is a mass function in M{F^ %Z ) at 
which the bound is attained. Reachable intervals produce a coherent lower prevision 

Zl 7l7 

Pq that is 2-monotone [4]. For 2-monotone lower previsions it holds that, given any 

two mutually exclusive events Z',Z" C Z, there is a mass function p^ z G M(P^ Kz ) 
for which p (Z'\n z ) = po+(Z'\n z ) and p (Z"\n z ) = po + (Z"\n z ). We shall use this 
property in the following. 

Observe that the representations in Cases 1 and 2 are fully general as any credal set can be 
represented by one or by the other. In the following we consider that all the local credal 
set of the net are specified either as in Case 1 or 2 or 3. We do not consider mixed cases, 
which should be easy to work out once the 'pure' cases have been addressed. 

Let us now focus on the complexity of testing credal dominance in Case 1 . Let S be the 
size of the largest local credal set in the network. The size is defined as the dimension of the 
constraints-variables matrix that describes the linear domain. Let 0(L(S)) be the complex- 
ity to solve a linear minimisation problem of size S. Note that this is a polynomial-time 
complexity [19]. We have that each minimisation in Eqs. (22)-(23) takes time 0(L(S)) 
at most. This holds also for the minimisation in (21) which can be converted to a linear 
minimisation problem by a result from Charnes and Cooper [ 1 ] . Note that each of the men- 
tioned minimisations must be repeated for all the joint states of the variables in FL| OR, 
whose number is upper bounded by the states of those in FL^ . Denoting by H the worst- 
case number of states of the variables in FL^ obtained by letting ;' vary from to m, we have 
that the overall computational complexity for Problems (22)-(23) is 0(H -L(S)) at most. 
We can regard this part as a pre-processing step of the test of credal dominance. Once the 
pre-processing is over, the set of minimisations in Eqs. (24)-(25) takes linear time in the 
size of B + as in the case of Bayesian networks. 

Case 2 presents a lower overall complexity for testing credal dominance. In fact, the 
minimisations in Eqs. (21)-(23) can be solved simply by enumerating the mass functions 
that make up each credal set. These mass functions are specified directly by the modeller, 
i.e., they are an input of the problem. For this reason the overall complexity of testing 
credal dominance is linear in the size of B + . 

The final case of probability intervals is also easily solved. With respect to Eqs. (22)- 
(23), p (ai\n' A .) and p (ai\n Aj ) are just the left and the right extreme of the probability 
intervals for (at\n A .) and {ai\n A ), respectively, so no computation is needed for them. As 
far as Eq. (21) is concerned, we have that the minimum of po(c'\nc) I Po{ c "\ftc) taken with 
respect to the mass functions in M (P^' %c ) is equal to p Q {c 1 \ 7tc) l~p§ (c" \ Tic) by the property 
mentioned at the end of Case 3. Again, p Q {c'\%c) an d Po( c "\ n c) are readily available as an 
input of the problem. Overall, the complexity of testing credal dominance is linear in the 
size of B + in this case as well. 

So far we have treated the case when B + is singly connected. The extension to the 
general case is completely analogous to that already developed for Bayesian networks, 
basically because the arcs leaving evidence nodes can be dropped in credal networks, too. 
The reason is that a credal net can be regarded as a set of Bayesian nets, and the mentioned 
property applies to all the Bayesian nets in the set. More precisely, assume, as in the 
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description at the end of Section 6, that a loop cutset is given that together with E can 
open all the loops in B + . Call R\ the loop cutset, and let R 2 be the set of nodes such that 
R = Ri UR 2 . Re-write the test of credal dominance for credal networks as 

Po(c'\e,r) 



mm mm 



pogm(£ ) reft p (c"\e,r) 



mm < mm 



{ 



mm < mm 

riGKi { P0 EM(P ) 



. p (c'\e,n,r 2 ) 
mm — — - 

r 2 G*2 Po{c"\e,ri,r 2 ) 

min Mc'k.n.ra) 



(30) 



(31) 



LieK 2 Po(c"|e,ri,r 2 )_ 

Eq. (30) makes it clear that for each selected mass function p Q e M(P ), the minimum in 
square brackets can be obtained on the graph B + that is made singly connected by dropping 
the arcs leaving EDR\. Of course this property continues to hold in the next expression. 
When we consider the part in braces in (31), that is, also the variations of po, we are 
focusing on the singly connected credal net, with graph B + , obtained from the multiply 
connected one dropping the arcs leaving E U/?i. Hence, Expression (31) shows that the 
inner double minimisation can be computed by Theorem 7. The outer minimisation is the 
usual enumeration of the states of the loop cutset. 

It turns out that the complexity of testing credal dominance when B + is multiply con- 
nected is the same both for credal and Bayesian networks. This is an important result, as 
the complexity to work with credal networks is usually much harder than that needed with 
Bayesian nets. 

8. Conclusions 

It seems to us that updating probabilities with incomplete observations presents an im- 
portant problem for research in uncertain reasoning, and is a pervasive issue in applications. 
It has been clearly pointed out in the literature that the commonly used CAR assumption 
about the incompleteness mechanism is often unjustified, and more generally, that it may 
happen in practical applications that little or no knowledge about the incompleteness mech- 
anism is available. In those cases, naive updating is simply inappropriate. 

This paper has addressed the problem of updating probabilities when strong assump- 
tions about the incompleteness mechanism cannot be justified, thus filling an important 
gap in literature. It has done so by deliberately choosing the conservative point of view 
of not assuming any knowledge about the incompleteness mechanism. A new so-called 
conservative updating method follows as a logical consequence, using only arguments of 
coherence. We used it to derive a new coherent updating rule for probabilistic expert sys- 
tems. By focusing on expert systems based on Bayesian nets, we have shown that this 
conservative updating leads to efficient classification of new evidence for a wide class 
of networks, so the new developments can be exploited immediately in real environments. 
Furthermore, the related algorithm can be implemented easily and does not require changes 
in pre-existing knowledge bases, so that existing expert systems can be upgraded to make 
our robust, conservative, inferences with minimal changes. 

We want to stress here that the proposed conservative updating strategy is different in 
one important respect from the more traditional ones: it generally leads only to partially 
determined inferences and decisions, and ultimately to systems that can recognise the lim- 
its of their knowledge, and suspend judgement when these limits are reached. As necessary 
consequences of our refusal to make unwarranted assumptions, we believe that these limi- 
tations are important characteristics of the way systems ought to operate in the real world. 
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A system that, in a certain state, cannot support any decision on the basis of its knowledge 
base, will induce a user to look for further sources of information external to the system. 
In contrast, systems that may make arbitrary choices without making that evident, will 
wrongly lead a user to think that also these choices are well motivated. 

We also believe it is important to stress here that it is difficult to avoid partial indeter- 
minacy in real applications. Realistic states of partial knowledge about the incomplete- 
ness mechanism, other than the total ignorance modelled here, should in principle also 
be modelled by a (non-vacuous) coherent lower prevision, which may again lead to in- 
determinacy except in very special cases, such as when enough information is available 
to justify modelling the incompleteness mechanism by a precise probability model. For 
analogous reasons, domain knowledge should most likely be modelled by a coherent lower 
prevision, too. In practise this can be done by moving from Bayesian to credal networks. 
It appears that this step has not really been taken so far, probably because of the compu- 
tational complexity of working in the more general framework of credal networks. This 
paper shows that the classification complexity is unchanged by moving from Bayesian to 
credal networks, in the realistic scenarios that involve a state of ignorance about the in- 
completeness mechanism. We hope that this encouraging result may contribute to credal 
networks receiving due credit also as practical modelling tools. 

With respect to future research, we believe an important issue is the development of 
models able to take advantage of intermediate states of knowledge about the incomplete- 
ness mechanism, to the extent of making stronger inferences and decisions. With regard to 
Bayesian and credal nets, one could for instance think of partitioning the set of attributes 
in those for which MAR holds and the rest for which the mechanism is unknown. Such 
hybrid modelling seems to provide a good compromise between generality and flexibility. 
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Appendix A. Extending Walley' s Marginal Extension Theorem 

This appendix is devoted to the proof of an important theorem, needed in Section 4. 
It is a generalisation to three random variables of Walley's Marginal Extension Theorem, 
discussed in Section 2.9 (see Theorem 1). Because the proof is rather technical, and it uses 
results and notions not explained in the main text, we have decided to discuss it separately. 

We consider three random variables X, Y and Z taking values in the respective non- 
empty and finite spaces X, V and Z. 

Theorem 8. Consider a coherent lower prevision P on £(X), a separately coherent con- 
ditional lower prevision P( ■ \X) on £(X X and a separately coherent conditional lower 
prevision P(- \X,Y) on £(X x y x Z). Then the smallest coherent lower prevision on 
£(X x y x Z) that has marginal P and is jointly coherent with P( - \X) and P(- \X,Y), 
is given by 

Q(h)=P(P(P(h\X,Y)\X)) (32) 

for all gambles h on X x ^ x Z. 
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Proof. Lemma 9 tells us that Q is a indeed a coherent lower prevision that has marginal P. 
To prove that Q, P( ■ \X) and P( ■ \X, Y) are jointly coherent, Walley's Reduction Theorem 
[37, Theorem 7.1.5] tells us that we need only prove that Q, P( - \X) and P(- \X,Y) are 
weakly coherent, and that P( - \X) and P( - \X,Y) are jointly coherent. This is done in 
Lemmas 10 and 11, respectively. Finally, in Lemma 12 we prove that any other coherent 
lower prevision on £(1 x ^ x Z) that has marginal P and is jointly coherent with P( ■ \X) 
and P( ■ \X,Y), dominates Q. □ 

Lemma 9. The lower prevision Q defined on £(X x y x Z) by Eq. (32) is coherent and 
has marginal P. 

Proof. It is easily verified that Q satisfies the axioms (£1)-(P3) of a coherent lower pre- 
vision, because the coherent P, and the separately coherent P( ■ \X) and P( -\X,Y) do so. 
It remains to show that Q has marginal P. Consider any gamble / on X. If follows from 
the separate coherence of P(- \X,Y) that P(f\X,Y) = f and consequently, from the sep- 
arate coherence of P(-\X) that P(P (f\X,Y)\X) = P{f\X) = f, whence indeed Q(f) = 

p(P(P(m,Y)\x))=P(f). a 

Lemma 10. Q, P( ■ \X) and P( -\X,Y) are weakly coherent. 

Proof. Following the discussion in [37, Section 7. 1 .4], we must prove that 

(a) max[G{f) + G{g\X) + G(h\X,Y)-G(fo)\ > 0; 

(b) msa.[G(f) + G{g\X) + G(h\X,Y)-G(go\xo)]>0; 

(c) max[G{f) + G{g\X) + G{h\X,Y)-G(ho\xo,yo)] > 0; 

for all /, /o, h, ho in £(X x y x Z), all g, go in £(X x y ), all xq in X and all yo in V, where 
we use the notations G{f)=f-Q{f), G{g\X) = g - P{g\X), G(h\X,Y) =h-P(h\X,Y), 
G(go\xo) =I{x Q }[g-P(g\xo)} andG(/z |x ,yo) = /{(^ 0J . )}N - P{h \xo,yo)]- 

To prove that (a) holds, recall from Lemma 9 that Q is a coherent lower prevision, 
whence (see for instance [37, Section 2.6.1] for properties of coherent lower previsions) 

max[G(/) + G(g\X) + G(h\X,Y) - G(/ )] 

>Q(G(f) + G(g\X) + G(h\X,Y)-G(fo)) 

> Q(G(f) + G(g\X) + G(h\X,Y))-Q(G(f )) 

> Q(G(f)) + Q(G(g\X)) + Q(G(h\X,Y))-Q(G(f )) 

Now, again using the coherence of Q, we find that Q(G(f)) = Q(f — Q(f)) = Q(f) — 
Q(f ) = and similarly Q(G(/o)) = 0. Moreover, it follows from the separate coherence 
of P(-\X,Y) that for all (x,y) in X x y 

P{G(h\XJ)\x,y)=P{h-P{h\X,Y)\x,y) 

= P(h-P(h\x,y)\x,y)=P(h\x,y)-P(h\x,y)=0, 

whence P(G(h\X ,Y)\X ,Y) = and consequently Q[G{h\X,Y)) = 0. Similarly, it follows 
from the separate coherence of P( - \X,Y) that P(G(g\X)\X ,Y) = G{g\X), and from the 
separate coherence of P( ■ \X) that for all x in X, 

P(P(G(g\X)\X,Y)\x) =P(G(g\X)\x)=P(g-P(g\X)\x) 

= P(g - P(g\x) W - P(g\x) - P(g\x) = 0, 

whence P(P{G(g\X)\X ,Y)\X) = and consequently also Q(G(g\X)) = 0. It follows that 
(a) is indeed verified. 
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An argument similar to the one above tells us that (b) will hold if we can prove that 
Q(G(go\x())) — 0. Now it follows from the separate coherence of P( - \X,Y) that, since 
G(g \xo) £ £(X x y), P(G(g \xo)\X,Y) = G(g \xo), whence, using the separate coherence 
ofP(-\X), 

P(P(G(go \x )\X,Y)\X) = P(G{g \xo) \X) 

= P(I {xo }lg(xo,-)-P(go(x ,-)\xoW) 

= I {xo} [P(g(xo, -)\X)- P(g (xo, ■ ) \xo)} = 0, 

whence indeed Q(G(go\xo)) = 0. 

Similarly, (c) will be verified if we can prove that Q(G(ho\xo,yo)) = 0. Now it follows 
from the separate coherence of P( -\X,Y) that 

P(G(h \x ,y )\X,Y) = P(I {{xQ ,y Q)} [h - P(h\xo,y )] \X,Y) 

= I {{wo)} [P(h\X,Y)-P(h\x ,yo)}=0, 

whence indeed Q(G(ho\xo,yo)) — 0. □ 

Lemma 11. Separately coherent conditional lower previsions P( - \X) on L(X x y) and 
P( ■ \X, Y) on £j(X x y x Z) are always jointly coherent. 

Proof. We use the discussion of joint coherence in [37, Section 7.1.4]. Consider arbitrary 
g in L(X x y) and h in L(X x y x Z) and the corresponding sets 

S(g) - {{x} x y x Z: g(x, ■ ) ± 0} and S(h) - {{x} x {>■} x Z: h(x,y, ■) + 0} . 

First of all, consider any xq in X and in £>(3C x y ), then we must show that there is some 
Bin 

S(g)US(h)U{{x }x]jxZ} 
such that (if we also take into account the separate coherence of P( ■ \X,Y) and P( ■ \X)) 

max [g(x,y) - P(g(x, -)\x) +h(x,y,z) -P(h(x,y, -)\x,y) 

{x,y,z)eB 

-I {xo] (x)(go(x,y)-P(g (x,-)\x))] >0 
We choose B = {xo} x y x Z, and prove that the corresponding supremum 

S = max max [g (x , y ) - P(g (x , ■ ) \x ) + h (x , y, z) - P(h (x , y, ■ ) \x , y) 

yey zeZ 

- (go(xQ,y) -P(go(xo, -)\xq))] >0. 
Now, since it follows from the coherence of the lower prevision P( ■ \xo,y) that 
max[h(x ,y,z) - P(h(x ,y, - )\xo,y)} > 

for all y £ y, we see that indeed 

S > max{g(x ,y) - P(g(x , ■ )\x ) - {go(x ,y) -P{go{xo, -)l x o))] > 0, 

where the last inequality follows from the coherence of the lower prevision P( • |xo). 

As a second step, consider any (xo,yo) in X x y and ho in L(X x y x Z), then we must 
show that there is some B in 

S(g)US(h)U{{x Q }x{y Q }xZ} 
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such that (if we also take into account the separate coherence of P( ■ \X,Y) and P( ■ \X)) 

max [g(x,y) - P(g(x, -)\x) +h(x,y,z) - P(h(x,y, -)\x,y) 

(x,y,z)eB 

- / {(^o,>'o)}( x ^)( /l o(x,}',z)-£(/zo(x,y, -)\x,y))] >0 

If g{x\, • ) ^ for some x\ ^ xq, then we choose B = {x\ } x y x Z, and similar arguments 
as in the first step of the proof lead us to conclude that the corresponding supremum 

maxmax [g(x u y) - P(g(xi , • ) \xi ) + h(x h y,z) - P(h(x u y, • ) \x { ,y)] 

is indeed non-negative. Assume therefore that g(x, •) = for all x ^ xq. Then there are 
two possibilities left. Either g(xo, ■ ) = 0, whence g = 0. Then we choose B — {xq} x 
{yo} x Z, and it follows from the coherence of the lower prevision P( ■ \xo,yo) that for the 
corresponding supremum; 

max[/z(x ,yo,z) - P(h(x ,yo, -)l*o,;yo) - (h {x ,yo,z) -P(h {x ,yo, Ohjo))] > 0. 

Or g(xo) ^ and then we choose B = {xq} x^xZ, and it follows, in a similar way as in 
the first step of the proof, that the corresponding supremum 

max [g(x ,y) - P{g{x , - )\x ) +h(x ,y,z) - P(h(x ,y, -)\x ,y) 

ye}),zeZ 

- / { ro }W( /z o(xo,3',z) - P(h (x ,y, -)\xo,y))] 
is again non-negative. □ 

Lemma 12. Any coherent lower prevision g' on£(Xx^xZ) that has marginal P and is 
jointly coherent with P( ■ \X) and P( ■ \X, Y), dominates Q. 

Proof. Consider any h in L(X x y x Z), then we have to prove that Q'{h) > Q(h). Since 
g jointly coherent with P( ■ \X) and P( • \X,Y), it follows that g, P{- \X) and P{ ■ \X,Y) 
are weakly coherent (see [37, Section 7.1.4]), and consequently we have for any ho, hi and 
g in L(X x y x Z), and any / in L(X x y) that 

max - g(h) +f-P(f\X) +g -P(g\X,Y) - (h - g(h ))] > 0. 

If we choose h Q = g = h,f = P(h\X,Y) and h\ = P{P(h\X,Y)\X), this reduces to 

g(h)>g(P(P(h\X,Y)\X)) 

and since P(P(h\X ,Y)\X) is a gamble on X, and Q 1 has marginal P, we find that 

&(P(P(h\XJ)\X))=P(P(P(h\XJ)\X)) = Q(h), 

whence indeed Q'(h) > Q(h). □ 



Appendix B. Additional discussion of the irrelevance condition (MDI) 

This appendix provides additional discussion of the irrelevance assumption (MDI) in 
Section 4. We use the notations established there. We shall restrict ourselves to the case 
that the lower prevision P and the conditional lower prevision P ( • \X) are precise. 

It turns out that if we make Assumption (MDI), coherence guarantees that another type 
of irrelevance is satisfied, as the following theorem makes clear. 
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Theorem 13. Assume we have a linear prevision Pq on L (X), and a linear conditional 
prevision Pq( ■ \X) on £(C x X). Also assume that the irrelevance condition (MDI) holds. 
Then for all x in X and c in C such that po(c,x) — po(x)po(c\x) > 0, and for all gambles f 
on 0, the conditional lower prevision P_(f\c,x) is uniquely determined by coherence, and 
given by 

E(f\c,x)=P(f\x)= mm f(o). 

oer(x) 

Proof. Let us first consider P({c} x {x} x 0). For any yel and p G 0, we have, by 
separate coherence, that 

P({c} x {x} x 0\y,p) = P(I {c}x{x}xO (-,y,p)\y,p) = I {x} (y)P(.{c}\y,p), 

whence P{{c} x {x} x 0\X,O) = I {x} P({c}\X ,0). Consequently, for all y G X, using 
separate coherence, Eq. (11) and the irrelevance condition (MDI), 

P(P({c} x {x} x 0\X,O)\y) = P(I {x} (y)P({c}\y,O)\y) 

= 7 wW p ™ I i n . Mi c }\ x >p) = 7 wCy) p ™n ) p o({c}W =i{ X }(y)po(c\x), 

whence P{P({c} x {x} x 0|X,O)|X) = 7{ x }/? (c|x), and therefore, 

P{{c} x {x} x O) = P (P{P({c} x W x 0|X,O)|X)) 

= ■Po( 7 {x}/'o(c|x)) = po WPo(c|x)) = po(c,x). 

The material in Section 2.7 then tells us that whenever P({c} x {x} x 0) = po(c,x) > 
0, P(f\c,x) is uniquely determined by coherence as the unique solution of the following 
equation in jj,: 

P('{c}xWxo[/-M]) = 0. (33) 
Now, for any y G X and p G 0, we have, by separate coherence, that 

P(kc}x{x}xo\f-ii]\y,p) = E.{i{c}x{x}xa(-,y,p)\f-ii]\y,p) 

= i{ X }(y)P{i{c}\f-v]\y,p), 

whence P(/ {c}x {4xo [/ - H] \X,0) = I{ X }P(I{ C } [f ~n]\X,0). Consequently, for all y G X, 
using separate coherence, Eq. (11) and the irrelevance assumption (MDI), 

p(P(i{c}x {x }xo\f-m,o)\y) 

= P(i {x} (y)P(hc}lf-n}\y,0)\y)=i { x}(y) mm P(I {c} \f{o)- n}\x,o) 

oer(x) 

= I {x} (y) rmn Po(I {c} \f{o)-n}\x)=I {x] (y) mm \f(o) - n}p (c\x) 
oer(x) oer( x ) 



= I {x}(y)po(c\x) 



mm fio) - a 



■l {x} (y)po(c\x)[P(f\x)-ii}, 



whence P(P(I{ c }x{ x }xo\X ,0)\X) = I {x] p (c\x)[P(f\x) - /i], and therefore, 
P(I{c}x{x}xO\f-n}) 

= Pq (P(P(I{c } x { X} x o [f ~ M] \X, O) \X) ) 

= Po(I{x}Po(c\x)[P(f\x) - m]) = Po (x)po(c\x)[P(f\x) - n] 

= p (c,x)\P(f\x)-n]. 

If po(c,x) > 0, it follows that the unique solution of Eq. (33) is indeed given by jj, — 
P(f\x)- ' ' □ 
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This theorem tells us that for a linear prior Pq, the irrelevance assumption (MDI) im- 
plies, through arguments of coherence, that conditional on the attributes X, the class C is 
irrelevant to the observations O, i.e., if we know that X = x, then the additional knowledge 
that C = c does not change our beliefs about the value of O. 

We now intend to show that the above statement does not imply (MDI). Let us, to this 
effect, start with a linear prevision Pq on L(Q x X), and assume that for all gambles / on 

0, and all (c,x) in C x X such that po(c,x) = po(x)po(c\x) > 0: 

P(f\c,x)=P(f\x)= min/( ). (I') 

oer(x) 

We can now use Walley's marginal extension theorem (see Theorem 1 in Section 2.9) to 
combine the marginal linear prevision Pq on £(6 x X) and the conditional lower prevision 
P( ■ \C,X) on L(0) — or, through separate coherence, on £(C x X x 0) — into a joint lower 
prevision 2on£,(6xlxO) defined by 

Q(h)=P (P(h\C,X)) 

for all gambles h on 6 x X x 0. The following theorem tells us that Assumption (MDI) is 
effectively stronger than Assumption (F). 

Theorem 14. Assume that (F) holds. Consider a separately coherent conditional lower 
prevision P( ■ \X,0) on £(C x X x 0). If this conditional lower prevision satisfies (MDI), 

1. e., 

P(f\x,o)=P (f\x) 

for all f G £(C) , for all x G X such that po(x) > 0, and for all o G r(x), then it cannot be 
jointly coherent with the joint lower prevision Q on XL (C x X x 0). 

Proof. Let x G X such that po(x) > and let o G Consider an arbitrary gamble / on 
6 that is not almost everywhere constant on 6 with respect to the linear prevision Pq( ■ \x) 
(which is uniquely determined from Pq through coherence). The theorem is proved if we 
can show that 

e(Lf-a/k* xW xw)<o. 

By separate coherence and Assumption (F), we find for any c G 6 and y G X that 

P(\f-P(f\x,o)]Iex{x}x{o})\c,y) 

= P(\f(c)-P(f\x,o)}I ex{x}x{o] (c,y,-))\c,y) 

= I {x} (y) nun [/(c) -P(f\x,o)]I {o} (p) 
P eT(x) 

- /{,} W{oy W min{/(c) - E(f\x, o) , 0} 

= I{x} (y)I{oY M min {/( c ) - p o(f\x),0} 
where the last equality follows from the assumptions of the theorem. Consequently, 

aLf-a/l^o)]/exWxw)|C,X)=/ w / {or Wrnin{/-P (/W,0} 
and we find that 

Q(\f-P(f\x,o)}I ex{x}x{o] ) 

= Po(P(\f-P(f\x,o)]I ex{x}x{o} )\C,X)) 

= Po(I {x] I{oy (x) min{/ - P (f\x),0}) 

= I [o y (x)P (I {x} min{/ - P (f\x),0}) 

= I {or (x)po(x)Po(mm{f-P (f\x),0}\x) < 0, 
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where the inequality follows from x G {o}*, po(x) > 0, and Lemma 15. □ 

Lemma 15. Let P be a linear prevision on £(C). Then for all gambles f on G that are not 
almost everywhere constant ( with respect to P), and for all real ji, we have that 

P(min{/-M,0})>0^M<P(/)- 

Proof. Let / be a gamble that is not constant almost everywhere, i.e., / is not constant on 
the set Dp = {ceC: p(c) > 0}, where we denote by p the mass function of P. It clearly 
suffices to show that P(min{/ — P(/),0}) < 0. Assume, ex absurdo, that P(min{/ — 
P(/),0}) > 0. Since the gamble min{/ — P(/),0} on G is non-positive, this implies that 
P(min{/-P(/),0}) = 0, and this can only happen if p(c) = P({c}) =0 for all c G G such 
that /(c) <P(f). Consequently, P(f) < /(c) for all c G D p , whence P(f) <min ceDp f(c). 
But since P(f) is a non-trivial convex mixture of the /(c) for all c G D p , and since / is not 
constant on D p , we also know that P(f) > min ceDp /(c), a contradiction. □ 
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